These questions are a starting point in getting a sense of how your school or district understands and responds to issues of student privacy.
Also, in looking at privacy and data storage, it will likely become necessary to differentiate between data that is considered an "educational record" and data that is not considered an educational record. The definition of educational records is part of FERPA. Under FERPA, parents also have rights to review and challenge data that is collected and stored as part of an educational record.
Other data will likely be covered under district policy and/or a vendor terms of service.
With that said, here are some questions to jumpstart the conversation:
Ask for a list of vendors who get educational records covered under FERPA.
Ask for a list of vendors who get student data that is not considered an educational record.
Ask to see executed legally binding contracts between the school (or district...