Heartland School Solutions
Round 1 · Operational Triage · Operational Triage — Round 1 · assessed
🟠 Insufficient — Request Data-Processing Agreement
Privacy score 73.3% · band Good
This reads as a general website privacy policy, not a data-processing agreement: 11 of 17 questions are simply not addressed. That's a wrong-document signal, not a vendor judgment — the 73.3% reflects silence, not bad practice. Enterprise vendors' real assurance lives in their DPA, a security cert (e.g. ISO 27001), or a completed questionnaire. Request those and assess in Round 2.
Unaddressed gate(s): Q3, Q5, Q16 — not covered by the public policy. Confirm before relying on this.
Quote check: 7 of 8 quotes found in the vendor's document. 1 not found (Q5). Each of those answers is set to unclear and cannot support an approval.
Q2, Q8, Q10, Q18: the quote joins separate passages with "...". Every part is in the document.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection |
| 100.0% |
| Purpose & Use GATE ⚠ |
| 20.0% |
| Data Sharing GATE ⚠ | n/a | — |
| Data Sold GATE |
| 100.0% |
| Data Rights |
| 100.0% |
| Retention | n/a | — |
| Data Security | n/a | — |
| Breach Notice | n/a | — |
| Biometrics & Surveillance GATE | n/a | — |
| Payments | n/a | — |
| AI & Model-Training GATE ⚠ |
| 20.0% |
| Jurisdiction & Residency |
| 100.0% |
| Contract & Assurance | n/a | — |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection and use of staff personal information to what the service needs?
? Not addressed
T0
Answer: Unclear
Policy lists many categories of personal information collected but does not state a principle of data minimisation or limit collection to what the service needs.
Q2Does the vendor name the categories of sensitive staff data it holds (government ID or SSN, bank details, health or benefits data, biometrics)?
✓ Good
T3
Answer: Yes
“Government-Issued Identifiers, including your Social Security number or other similar government identifiers... Payment Information, including credit or debit card numbers or other financial account information... Health/Medical Information, including food allergy information.”
Policy names SSN, bank/payment details, and health data (food allergies).
Purpose & Use
Q3Does the vendor commit to use the school's data only to provide the contracted service, and not for its own purposes? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state that customer data is processed only on customer instructions or only to provide the service. It describes use for service provision but also for other business purposes.
Q4Does the vendor use school or staff data for marketing, profiling or product analytics beyond operating the service?
✗ Concern
T3
Answer: Yes
“we may anonymize or aggregate your personal information so that you are not identified or identifiable from it, in order to use the anonymized or aggregated data. For example, we may use anonymized or aggregated data for statistical analysis including to analyze trends, for product development, and for risk assessments and cost analysis.”
Policy states use of data for product development and analytics beyond operating the service, though it claims data is anonymized/aggregated.
Data Sharing
Q5Does the vendor limit sharing with third parties to the purpose for which the data was collected? GATE
? Not addressed
T0
Answer: Unclear
Sharing is limited to service providers, customers, legal requirements, and third parties at user direction, which aligns with purpose limitation. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “To our affiliates to provide you with our Services or to manage our business... To non-affiliated service providers... To non-affiliated entities with whom you have a business relationship... To our Customer with whom you are also engaging... To banks and payment providers to authorize and complete card payments... To other third parties to whom you direct us to disclose personal information about you... To regulators... When we believe that disclosure is necessary or appropriate to comply with laws...”
Q6Does the vendor publish or offer a list of sub-processors, naming its cloud host, and commit to notice before adding one?
? Not addressed
T0
Answer: Unclear
Policy does not publish a sub-processor list, name a cloud host, or commit to notice before adding sub-processors.
Data Sold
Q7Is staff or school personal information ever sold or rented to any outside party? GATE
✓ Good
T3
Answer: No
“We do not sell or "share" (for purposes of cross-context behavioral advertising) the personal information, including the sensitive personal information, of minors under 16 years of age.”
Policy states it does not sell or share personal information of minors under 16. For adults, the policy addresses opt-out rights but does not explicitly state a blanket prohibition on sale.
Data Rights
Q8Does the vendor support access, correction and deletion requests from the school, with a stated process or response time?
✓ Good
T3
Answer: Yes
“If you interact with our Services and provide personal information to us directly, subject to certain exceptions and depending on how you interact with our Sites, Apps, or Services and where you reside, you may have the right to... Access, request and receive the personal information we have collected in a portable manner... Request that we correct inaccuracies in personal information about you; and Request that we delete personal information about you. You may contact us using the information in the "Contact Us" section of this Notice for additional information about how to exercise your rights.”
Policy describes access, correction, and deletion rights with contact information provided (privacy@globalpayments.com, 855-832-5226). No specific response time stated.
Q9Does the school keep ownership of its data, with return or deletion at the end of the contract?
? Not addressed
T0
Answer: Unclear
Policy states 'Certain personal information that we receive from our Customers is subject to the Family Educational Rights and Privacy Act, and between us and our Customers, is owned by the Customers' but does not explicitly address return or deletion at end of contract.
Retention
Q10Does the vendor state a retention period for staff data after the service ends, and whether deletion is automatic?
? Not addressed
T3
Answer: Unclear
“We retain the personal information we collect for different periods of time depending on what it is and how we use it... When we collect personal information, we will retain it only for as long as is necessary to complete the legitimate business or legal purposes for which we collected it.”
Policy describes retention criteria but does not state a specific retention period or automatic deletion rule after service termination.
Data Security
Q11Does the vendor disclose baseline safeguards: encryption in transit and at rest, single sign-on with MFA for admin roles, and an independent attestation (SOC 2, ISO 27001) or equivalent?
? Not addressed
T3
Answer: Unclear
“We maintain administrative, technical and physical safeguards designed to protect personal information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.”
Policy mentions safeguards but does not name encryption standards (TLS, AES), SSO/MFA for admin access, or independent attestations (SOC 2, ISO 27001).
Breach Notice
Q12Does the vendor commit to notify the customer of a security incident without undue delay, with a stated hour count?
? Not addressed
T0
Answer: Unclear
Policy does not commit to notifying customers of security incidents without undue delay or within a stated timeframe.
Biometrics & Surveillance
Q13For products that capture faces, fingerprints or other biometric identifiers: does the vendor require written notice and consent before collection, and publish a retention and destruction schedule? GATE
— N/A
T0
Answer: N/A
not applicable to this product type
Q14Does the vendor use customer video, images or biometric data for its own analytics or model training?
— N/A
T0
Answer: N/A
not applicable to this product type
Payments
Q15For products that take card payments: does the vendor state PCI DSS compliance and name the scope it covers for the customer?
? Not addressed
T0
Answer: Unclear
Policy does not state PCI DSS compliance or name the scope it covers for the customer.
AI & Model-Training
Q16Does the vendor use customer or staff data, including uploaded documents, to train or improve AI or machine-learning models? GATE
? Not addressed
T0
Answer: Unclear
Policy does not disclose whether customer or staff data is used to train or improve AI or machine-learning models.
Q17Does the vendor disclose automated decisions that affect staff (screening, scheduling, pay, access) and offer human review?
✗ Concern
T0
Answer: No
Policy does not disclose automated decisions affecting staff (screening, scheduling, pay, access). The service is primarily a payment and cafeteria management platform for parents and students, not an HR or staff management system.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy laws it complies with?
✓ Good
T3
Answer: Yes
“Because our affiliate companies are located around the globe, personal information may be transferred to and stored in the United States or in another country outside of the country in which you reside... We take appropriate steps to transfer personal information in accordance with applicable law, such as transferring personal information to countries that are recognized as providing an adequate level of legal protection or where alternative adequate arrangements are in place to protect your privacy rights.”
Policy discloses storage in the United States and other countries. Compliance with GDPR, CCPA, and other regimes is referenced in the region-specific section.
Contract & Assurance
Q19Does the vendor offer a data-processing agreement or equivalent written terms to customers?
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state that a data-processing agreement or equivalent contractual data terms are available to customers.
Jurisdiction & residency — your footprint
Vendor named 2 of 4 countries in your footprint. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“Because our affiliate companies are located around the globe, personal information may be transferred to and stored in the United States or in another country outside of the country in which you reside... Certain personal information that we receive from our Customers is subject to the Family Educational Rights and Privacy Act...”
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ✓ Named |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ✓ Named |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ✓ Named |