New York Data Privacy and Security

Last updated: November 10, 2026

 

1. Purpose and Scope

 

NextPitch and New York users

 

NextPitch Educational Services, LLC operates from Missouri and supports New York users through the protections in our Privacy & Security and Innovator Data Policy, supplemented by applicable New York law. A Missouri governing-law clause does not waive nonwaivable New York protections.

 

School contracts and general services

 

New York Education Law § 2-d and 8 NYCRR Part 121 apply to covered education data and third-party contractor relationships. Other New York data security and breach notification laws may apply to personal information outside school use, including corporate participation. This page does not represent that every user relationship is a covered school contract.

 

2. Covered Educational Data

 

Student records and protected personnel data

 

Covered data includes personally identifiable information from student records and, where received under a covered agreement, protected teacher or principal performance-review data. NextPitch does not require teacher or principal evaluation records for ordinary pitch participation.

 

Purpose-limited processing

 

For covered school services, we use protected information only to provide the contracted educational service and as otherwise lawfully authorized. Access must be limited to personnel and providers who need it for that purpose. Covered information may not be sold or released for prohibited commercial purposes.

 

3. Parent and Eligible Student Protections

 

Access, accuracy, and confidentiality

 

Parents and eligible students have rights to inspect and review education records and pursue correction under applicable law. Identifiable records must be protected by appropriate safeguards. Privacy complaints must be addressed through the responsible educational agency and applicable state process.

 

Requests involving NextPitch

 

Email Hello@MyNextPitch.com with the subject “New York Innovator Data Request.” Identify the school or program and the requested action without attaching sensitive records. We will verify authority, coordinate with the responsible educational agency, and support its lawful response. The agency’s data protection officer administers its school-record process.

 

The agency’s Parents’ Bill of Rights

 

The educational agency must publish and include its required Parents’ Bill of Rights and contract-specific supplemental information. This general NextPitch notice supplements those materials and does not substitute for the agency’s own required statement.

 

4. Required Contract Documentation

 

Before covered records are provided

 

A covered relationship requires an appropriate agreement and data security and privacy plan addressing the applicable legal and agency requirements. Public website Terms alone do not complete this process. The agreement must identify the educational purpose, necessary data elements, authorized access, restrictions, and duration.

 

Supplemental disclosures

 

Required contract-specific information must address the contract’s purpose and expiration; provider compliance; return, transfer, or destruction of data; how record accuracy may be challenged; storage locations; and security measures, including applicable encryption at rest and in transit. Those details must reflect the actual service and provider arrangement.

 

Security and provider obligations

 

Covered arrangements must include legally required safeguards, training, confidentiality restrictions, subcontractor protections, and a security and privacy plan consistent with applicable requirements, including the agency’s NIST-aligned framework. We do not represent that this public page certifies an audit, a particular hosting location, or an implemented control.

 

5. Incidents and Breach Notification

 

Covered educational incidents

 

For an incident subject to 8 NYCRR § 121.10, NextPitch must notify the affected educational agency promptly and without unreasonable delay, and no later than seven calendar days after discovery. A shorter contractual deadline controls when applicable. We must cooperate in the investigation and required response, including legally required allocation of notification costs.

 

Agency notices and general New York law

 

The educational agency has its own reporting and affected-person notification duties. For other covered New York private information, applicable requirements under General Business Law §§ 899-aa and 899-bb govern reasonable safeguards and breach notification. One notice process does not displace another applicable obligation.

 

Report a concern

 

Email Hello@MyNextPitch.com with the subject “New York Data Incident.” Provide the affected page or account and a concise description. Do not email passwords, full innovator records, or financial credentials.

 

6. Young Innovators and Public Pitches

 

Pre-K participation and under-13 use

 

Young innovators may participate through authorized adult-managed submissions. Direct collection from children under 13 is subject to applicable notice, consent, and school-authorization requirements described in the Innovator Data Policy, including any legal exception. School authorization is limited to lawful educational processing.

 

Separate permission for public disclosure

 

A covered educational relationship does not by itself authorize public display of identifiable student work, names, images, or recordings. Required permission and the lawful basis for disclosure must be established before publication. Restricted records must not become public merely because a challenge joins a community or network.

 

7. Retention, Deletion, and Corporate Users

 

Educational record lifecycle

 

Covered agreements must state what happens to data at expiration, including authorized return, transfer, or secure destruction. Retention must follow the educational purpose, agreement, and law. A innovator’s work is not automatically transferred into an unrelated commercial profile after the school relationship ends.

 

Corporate and community information

 

Adult workplace and community users are covered by the general privacy policy and their organization’s applicable agreement. Employers and hosts must have authority for submissions and protect confidential information. Appropriate New York security duties may apply even where Education Law § 2-d does not.

 

8. Contact and Further Information

 

NextPitch privacy contact

 

NextPitch Educational Services, LLC • Missouri, United States

 

Email: Hello@MyNextPitch.com

 

Privacy & Security: https://www.mynextpitch.com/privacy-policy

 

Innovator Data Policy: https://www.mynextpitch.com/student-data-policyy

 

State education resources

 

New York State Education Department data privacy and security information: https://www.nysed.gov/data-privacy-security

 

Education Law § 2-d: https://www.nysenate.gov/legislation/laws/EDN/2-D

 

This notice may be revised by posting an updated version and date. Notice and consent requirements for revisions are governed by applicable law and any governing agreement.

 

​