Privacy Policy

Lyons Township High School District 204 will never provide your email address to another party, unless specifically authorized by you. Your email address will be used exclusively for communications between the school district and you, the parent/guardian.

BOE Protection of Student Personal Information Online

7:345 Protection of Student Personal Information Online

As authorized by state and federal law, the District may outsource institutional services or functions that involve the disclosure of education records/school student records to contractors, consultants, volunteers, and other third parties acting as “school officials” as defined by the Illinois School Student Records Act (ISSRA) and the Family Educational Rights and Privacy Act (FERPA).

Such school officials:

Perform institutional services or functions for which the District would otherwise use employees;
Are under the direct control of the District with respect to the use and maintenance of education records;
Only use personally identifiable information (PII) from education records for the purposes for which the disclosure was made and do not redisclose PII from education records without the District’s permission; and
Meet the criteria specified in the District’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Some school officials and other technology vendors are operators of Internet websites, online services, online applications, or mobile applications that are designed, marketed, and primarily used for K-12 school purposes; these entities are defined as “operators” under the Illinois Student Online Personal Protection Act, 105 ILCS 85/ et seq. (SOPPA).

The use of such operators’ services and technologies may involve the creation or sharing of “covered information,” as defined by SOPPA, which means student PII or information linked to PII in any media or format that is not publicly available and is any of the following:

(1) created by or provided to an operator by a student or the student’s parent/guardian in the course of the student’s or parent/guardian’s use of the operator’s site, service or application;

(2) created by or provided to an operator by an employee or agent of the District; or

(3) gathered by an operator through the operation of its site, service, or application.

The sharing of covered information with operators must comply with all requirements of ISSRA, FERPA, and SOPPA.

The Board designates the Superintendent to serve as Privacy Officer, who shall ensure the District complies with the duties and responsibilities required of it under SOPPA, ISSRA, and FERPA, including, but not limited to, all requirements related to posting information about the use and disclosure of covered information, providing notice of a breach of covered information, and implementing and maintaining reasonable security procedures and practices.

The Privacy Officer designates which District employees are authorized to enter into written agreements with operators for those contracts that do not require separate Board approval. Such designation does not limit individual school employees outside of the scope of their employment from entering into agreements with operators on their own behalf and for non-“K through 12 school purposes,” as that term is defined in SOPPA, provided that no covered information is provided to the operators. Any agreement or contract entered into for K through 12 school purposes by an employee without designation by the Privacy Officer is void and unenforceable as against public policy.

LEGAL REF.:

20 U.S.C. §1232g, Family and Educational Rights and Privacy Act; 34 C.F.R. Part 99.

105 ILCS 10/, Ill. School Student Records Act.

105 ILCS 85/, Student Online Personal Protection Act.

23 Ill. Admin. Code Part 380.

CROSS REF.: 4:15 (Identity Protection), 4:60 (Purchases and Contracts), 6:235 (Access to Electronic Networks), 7:340 (Student Records)

ADOPTED: February 22, 2022

Lyons Township High School District 204

Online Privacy Statement

The School District respects the privacy of all website visitors to the extent permitted by law. This Online Privacy Statement is intended to inform you of the ways in which this website collects information, the uses to which that information will be put, and the ways in which we will protect any information you choose to provide us.

There are four types of information that this site may collect during your visit: network traffic logs, website visit logs, cookies, and information voluntarily provided by you.

Network Traffic Logs
In the course of ensuring network security and consistent service for all users, Lyons Township High School District 204 employs software programs to do such things as monitor network traffic, identify unauthorized access or access to nonpublic information, detect computer viruses and other software that might damage District 204 computers or the network, and monitor and tune the performance of the District network. In the course of such monitoring, these programs may detect such information as e-mail headers, addresses from network packets, and other information. Information from these activities is used only for the purpose of maintaining the security and performance of the District’s networks and computer systems. Personally identifiable information from these activities is not released to external parties without your consent unless required by law.

Website Visit Logs
The District 204 website routinely collects and stores information from online visitors to help manage those sites and improve service. This information includes the pages visited on the site, the date and time of the visit, the Internet address (URL or IP address) of the referring site (often called “referrers”), the domain name and IP address from which the access occurred, the version of browser used, the capabilities of the browser, and search terms used on our search engines. This site makes no attempt to identify individual visitors from this information; any personally identifiable information is not released to external parties without your consent unless required by law.

Cookies
Cookies are pieces of information stored by your web browser on behalf of a website and returned to the website on request. This site may use cookies for two purposes: to carry data about your current session at the site from one webpage to the next and to identify you to the site between visits. If you prefer not to receive cookies, you may turn them off in your browser, or may set your browser to ask you before accepting a new cookie. Some pages may not function properly if the cookies are turned off. Unless otherwise notified on this site, we will not store data, other than for these two purposes, in cookies. Cookies remain on your computer, and accordingly we neither store cookies on our
computers nor forward them to any external parties. We do not use cookies to track your movement among different websites and do not exchange cookies with other entities.

Information Voluntarily Provided by You
In the course of using the LTHS website, you may choose to provide us with information to help us serve your needs. For example, you may send us an email to request information, an application or other material, and you may sign up for a mailing list. Any personally identifiable information you send will be used only for the purpose indicated. Requests for information will be directed to the appropriate staff and may be recorded to help us update our site. We will not sell, exchange, or otherwise distribute your personally identifiable information without your consent, except to the extent required by law. We do not retain the information longer than necessary for normal operations.

Each webpage requesting information discloses the purpose of that information. If you do not wish to have the information used in that manner, you are not required to provide it. Please contact the person listed on the specific page, or listed below, with questions or concerns on the use of personally identifiable information.

While no system can provide guaranteed security, we take reasonable efforts to keep information you provide to us secure, including encryption technology (if any), and physical security at the location of the server where the information is stored.

Communication Preferences
You can stop the delivery of informational emails from District 204 by following the specific instructions in the email you receive. Depending on the respective service, you may also have the option of proactively making choices about the receipt of email, telephone calls, and postal mail for particular District information and activities.

Links to Non-District Websites
District websites provide links to other websites or resources. We do not control these sites and resources, do not endorse them, and are not responsible for their availability, content, or delivery of services. In particular, external sites are not bound by this Online Privacy Statement; they may have their own policies or none at all. Often you can tell you are leaving a District website by noting the URL of the destination site. These links to external websites open a new browser window as well.

Please email your questions or concerns to Mary Lin Muscolino, the District's coordinator of communications - mmuscolino@lths.net.

Email and Phone for District 204 Communications

This Privacy Policy explains how Lyons Township High School District 204 collects, uses and discloses personal information of its students, prospective students, and parents/guardians to its website at LTHS.NET. Lyons Township High School District 204’s Student Information System allows the school district to communicate electronically with parents about their student’s academic progress. In order to do so, District 204 collects an email address to send notifications to parents/guardians via email. If you do not have an email address, one can be obtained by going to GMAIL.COM YAHOO.COM HOTMAIL.COM or one of the many other email service providers.

PRIVACY STATEMENT

COLLECTION OF PERSONAL INFORMATION

[DRAFTING NOTE: Use this section to describe the types of information you collect about identifiable individuals and how you collect it (e.g., directly from the user, through online tracking technologies or from other sources such as advertising partners or other third parties).] Information collected directly from you: We may collect personal information directly from you, for example [through a web form, during an online or in-person registration, while making a reservation, while setting up an account with us, when you contact us for customer support, or at checkout.] Personal information we collect directly from you may include [first and last name, address, email address, and phone number.] Information collected from your device: Our website may use tracking technologies such as cookies, web beacons, pixels, and other similar technologies to automatically collect certain information from your device, including for example [your IP address, browser and operating system information, geographic location, referring website address, and other information about how you interact with the website.] Our website may also use cookies to personalize your experience and enable certain features [such as keeping track of items you put in your shopping cart.] You may disable cookies in your web browser however parts of our website may not function properly. More information about blocking and deleting cookies is available at http://www.allaboutcookies.org. Our email campaigns may also use tracking technologies such as web beacons, pixels and other similar technologies to automatically collect certain information such as your IP address, browser type and version, and email engagement statistics. Information collected from our advertising partners: We may collect personal information about you from our advertising partners. Personal information we collect from our advertising partners may include [your demographic information, shopping history, and geographic location.]

USE OF PERSONAL INFORMATION

[DRAFTING NOTE: Use this section to describe how you use each type of personal information described in the collection section above.] We use information collected directly from you to provide you with [our products and services, customer service and support, and other relevant information.] We may also use this information to market our products and services to you, including by email and text message subject to your consent. We use information collected automatically from your device [to provide our website to you, to optimize our website, and to assist with our advertising and marketing efforts.] We may also use information collected from you and information collected from your device to send you abandoned cart reminders if you added items to your shopping cart but did not complete check out. We use information collected from our advertising partners to [market our products and services to you.]

DISCLOSURE OF PERSONAL INFORMATION

[DRAFTING NOTE: Use this section to describe the third parties to whom you provide the personal information you collect. If you sell, rent or lease personal information, we recommend consulting with your legal counsel about your obligations.] We may use third-party service providers to assist us with providing and marketing our products and services to you and we may share your information with such third parties for these limited purposes.

● We use Constant Contact for our email marketing communications. For more information about how we may use your information with Constant Contact and the information that may be collected through our email campaigns, see Constant Contact’s Customer Data Notice available here.

● We use Google Analytics to help us understand how visitors interact with our website. Google Analytics uses and processes your information in accordance with its privacy policy available here.

● We use [insert online store provider] to provide our online store. [Insert online store provider] uses and processes your information in accordance with its privacy policy available at [insert online store’s privacy policy].

● We use [insert payment processor] as our payment processor. [Insert payment processor] uses and processes your payment information in accordance with its privacy policy available at [insert payment processor’s privacy policy].

EMAIL AND TEXT MESSAGE COMMUNICATIONS

If you wish to unsubscribe from our email campaigns, please click on the Unsubscribe link at the bottom of any marketing email sent from us. If you wish to stop receiving text messages from us, reply STOP, QUIT, CANCEL, OPT-OUT, or UNSUBSCRIBE to any text message sent from us. For more information, see our Mobile Messaging Terms and Conditions available at [insert link to your mobile terms].

YOUR PRIVACY RIGHTS

[DRAFTING NOTE: Depending on the privacy legislation that is applicable to you, you may be required to provide your users with certain rights to access, correct and delete the data you hold about them. We recommend consulting with your legal counsel about your obligations.] You may have the right to request access to the personal information we hold about you, to port it to a new service, or to request that your personal information be corrected or deleted. To exercise any of these rights, please contact our Director of Technology at etennant@lths.net.

CHANGES TO THE THIS PRIVACY POLICY

We may update this Privacy Policy at any time. Please review it frequently.

CONTACT INFORMATION

If you have any questions about this policy or our privacy practices, please contact our Director of Technology at etennant@lths.net.

Most Recent Update: [7/2/2024]

Student Data Privacy

How is access to student data managed?

District 204 follows best practices in establishing and managing system and network access security. An Information Security Policy governs all access and control measures to protect District data. Access to student data is managed and controlled through what is known as role-based security. This means that the type and amount of access to student data and other information is governed in our systems by the role which any staff member holds in the District along with what information they require to perform their job. Staff members must go through a process to gain access to authorized information that includes successfully logging into the District network or one of the systems they use as part of their job duties.

District 204’s authentication requires staff to use their District assigned Active Directory username and password or an application specific username and password to gain access to functionality and data residing in our systems. These usernames and passwords are specific to individual staff or system users. Once a staff member logs in using this method the internal application controls role based security.

Application permission restrictions are engaged which limit the data read, write, add or delete functionality and are specific to a staff member’s role in the District. This process is also used by our District 204 parents/guardians when accessing information specific to their students in any of our systems.

The district also follows all rules set forth by state and federal government such as the Family Educational Rights and Privacy Act (FERPA), Protection of Pupil Rights Amendment (PPRA), and the Health Insurance Portability and Accountability Act (HIPAA). For more information regarding these laws, please refer to the following links:

HEALTH INFORMATION PRIVACY

FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT (FERPA)

PROTECTION OF PUPIL RIGHTS AMENDMENT (PPRA)

Where is student data held and where does it go?

The primary repository of student data is our Student Information System, eSchoolPlus. eSchoolPlus maintains student demographics, household contact information, enrollments, attendance, grades, schedules, transcripts, discipline, bus, lockers, health, and LEP information. The District does not retain student Social Security Numbers within any system. In addition to the eSchoolPlus system, the Technology Services department also maintains multiple supporting systems that assist in running the daily operations of the District. Based on need, some excerpts of student data are routinely transferred between these applications through a variety of secure and encrypted system integration processes. Additionally, many of these applications are internally hosted in our secure primary and secondary data centers. Physical access to these data centers and the servers that house this data is limited to a small group of network and application administrators in the Technology Services department. D86 data centers are secured, include fire protection and power backup capabilities. Routine back-ups of key systems and data are processed on a regular schedule, which are securely stored and protected.

With the evolution of Cloud-based applications, the District also subscribes to some externally hosted applications which are integrated with our Student Information System through encrypted data communications. Below is a list of some of the various outside agencies that the district provides data to, and or receives data from, via secured, encrypted data transfer interfaces.

Regular basis - Learning Management System (Canvas), Library Management System (Follett), and mass notification system (BlackBoard Connect). Data transferred includes basic student information such as student names, student schedules, teachers, and teacher
Periodic basis - Testing agencies such as ACCESS, ACT, AP, PSAT, and These tests typically include basic student demographics to identify the student and student schedules used for test scheduling purposes.
Occasional basis – Military, picture companies (LifeTouch), fundraising (Booster Clubs, D86 Foundation), institutions of higher education, and The Illinois High School Association (IHSA), which typically contains basic student information only.
Government entities – Required data is shared on a daily, weekly, monthly, quarterly, and annual basis to the Illinois State Board of Education (ISBE). The Department of Education Office of Civil Rights requires the District to supply various data and/or This data can contain detailed student demographic data, enrollment data, discipline data, grades, IEP, 504, LEP, and Free and Reduced Lunch information.

If problems occur that require application support personnel from one of the District’s solution providers, access to these applications by the vendor is granted to correct issues or perform system maintenance and upgrades.

Data Services Agreement

District 204 has established non-disclosure agreements with vendors as well as having information confidentiality language included in the Data Services Agreements. Additionally, when selecting new vendors the District requires that the vendor have a secure data transfer process, physically secured data centers, role- based security, and contract language that addresses information confidentiality and non-disclosure clauses.

Student Online Personal Protection Act (SOPPA)

What is SOPPA?

The Student Online Personal Protection Act is a new data privacy that went into effect on July 1, 2021. Websites, online services and mobile apps that are designed, marketed and used for K–12 school purposes must comply with SOPPA regardless of whether they have a contract with a school or district.

What does it mean to be SOPPA-compliant?

If a vendor states that they are SOPPA-compliant, that means that they are:

Not using collected data to provide targeted ads;
Not profiling students except in furtherance of school purposes;
Not selling or renting student information;
Not disclosing information unless required to by law or as part of the maintenance and development of its service;
Using sound security practices;
Deleting student data when requested by the school or district;
Publicly disclosing information about its use, terms of service, agreement, and privacy policy;
Entered into a written agreement with the school district.

Student Online Personal Protection Act (SOPPA) Notice

School districts throughout Illinois contract with different vendors for services that enable them to provide personalized learning, access innovative educational technologies and increase efficiency in school operations.

Under the state's Student Online Personal Protection Act (SOPPA), educational technology vendors and other entities that operate websites, online services, online applications, or mobile applications that are designed, marketed, and primarily used for K-12 school purposes are referred to in SOPPA as operators. SOPPA is intended to ensure that student data collected by operators is protected. It also requires those vendors, school districts and the Illinois State Board of Education to take a number of actions to protect online student data.

Depending on the educational technology that is being used, our district may need to collect different types of student data that is then shared with vendors through their online sites, services and/or applications. Under SOPPA, vendors are prohibited from selling, renting or engaging in targeted advertising using a student’s information. Such vendors may only disclose student data for K-12 school purposes and other limited purposes permitted under the law.

In general terms, the types of student data that may be collected and shared include personally identifiable information (PII) about students or information that can be linked to PII about students. Below are examples of this information.

Basic identifying information for students and parents/guardians that includes their name, contact information, username/password and student ID number
Demographic information
Enrollment information
Assessment data, grades and transcripts
Attendance and class schedule
Academic/extracurricular activities
Special indicators (e.g., disability information, English language learner, free/reduced meals or homeless/foster care status)
Conduct/behavioral data
Health information
Food purchases
Transportation information
In-application performance data
Student-generated work
Online communications
Application metadata and application use statistics
Permanent and temporary student record information for school

Operators may collect and use student data only for K-12 purposes that aid in the administration of school activities such as:

Instruction in the classroom or at home (including remote learning)
Administrative activities
Collaboration between students, school personnel and/or parents/guardians
Other activities that are for the use and benefit of the school district

Notice of Parent Rights Regarding Student Covered Information

The contact information for the District’s Privacy Officer or other staff member designated to respond to parent/guardian requests for their child’s covered information follows:

Edward C. Tennant - Director of Technology

708-579-6478 etennant@lths.net

Under the Illinois Student Online Personal Protection Act (SOPPA), you have the right to review your child’s covered information. Covered information means personally identifiable information (PII) or information linked to PII in any media or format that is not publicly available and is any of the following: (1) created by or provided to an operator by a student or the student’s parent/guardian in the course of the student’s or parent/guardian’s use of the operator’s site, service or application; (2) created by or provided to an operator by an employee or agent of the District; or (3) gathered by an operator through the operation of its site, service, or application. Operators are entities (such as educational technology vendors) that operate Internet websites, online services, online applications, or mobile applications that are designed, marketed, and primarily used for K-12 school purposes.

Under SOPPA, you have a right to:

Request to inspect and review your child’s covered information, whether it is maintained by the District, the Ill. State Board of Education (ISBE), or an operator.
The District will provide you with the opportunity to inspect and review your child’s covered information within the timeframe prescribed by State rules.
If the covered information requested includes data on other students, your access will be limited to the covered information relevant to your child.
If the covered information you request includes your child’s school student records, the District will permit you to inspect and review any school student records of your child in accordance with the District’s procedures for student records requests.
Request a copy of your child’s covered information, in electronic or paper form.
The District will provide the copy to you within the timeframe prescribed by State rules.
If you request an electronic copy, the District will provide you the copy in an electronic format, unless the District does not maintain the information in electronic format and reproducing it in an electronic format would be unduly burdensome to the District.
If you request a paper copy, the District will charge you the reasonable cost of copying in the amount authorized by State rules. However, you will not be denied a copy if you have an inability to pay.
You are limited to the number and frequency of copying requests provided by State rules.
If the covered information you request includes your child’s school student records, the District will provide a copy of your child’s school student records to you in accordance with the District’s procedures for student records requests.
Request corrections to factual inaccuracies contained in your child’s covered information. Upon receipt of a request, the District will take the following steps:
The District will review your request and determine if the factual inaccuracy exists.
If the District determines that a factual inaccuracy exists, and the District maintains or possesses the covered information, it will correct the inaccuracy and confirm the correction with you within 90 calendar days after receiving your request.
If the District determines that a factual inaccuracy exists and an operator or ISBE maintains the information, the District will notify the operator or ISBE of the factual inaccuracy and the correction to be made. The operator or ISBE is required to confirm the correction with the District within 90 calendar days after it receives the District’s notice. The District will then confirm the correction with you within 10 business days after it receives the confirmation of the correction from the operator or ISBE.
If the covered information you are requesting be corrected includes your child’s school student records, the District will follow its procedures for amendment of student records with respect to those school student records.

To make a request to inspect and review, copy, and/or correct your child’s covered information, please contact the staff member identified above and specify the nature of your request. You will need to submit your request in writing. The Registrar at the school can be contacted for the form.