Privacy and Data Security Policy for Class Creator

At Class Creator we hold our users privacy and security in the highest regard. Below are the guidelines we use in regards to collecting, using, storing and protecting information. It is not an exhaustive statement, so if you have any questions or require any additional information please contact us at info@classcreator.io.

Class Creator Website

1. General

The Class Creator website is designed to inform current and potential users of Class Creator of relevant features, pricing, processes and information associated with using our software. The information contained on this website is subject to change without notice. While we take care to ensure our website is current and accurate, we are not responsible for technical, pricing or typographical errors.

All associated logos, content, designs and copy are under copyright to Pigeonhole Software Pty Ltd. Class Creator is a registered trademark, created and owned by Pigeonhole Software Pty Ltd. The use of the Class Creator logo may not be used without our prior written permission.

2. Collected Information

Educational institutions that sign up to use Class Creator will be recorded and shared publicly on our blog and other social media. If you are an institution that does not wish to be recorded as a user of Class Creator and/or shared publicly, please contact us at info@classcreator.io and no information will be published in regards to your school.

Class Creator uses Google Analytics to gather various information from our visitors in regards to their origin and behaviour on our website. This information is used to optimise our website.

The Class Creator website uses cookies, they allow us to recognise when you return to certain sites and allow us to register user preferences. A cookie is sent from our server and automatically placed on your computer without notification. Personal preferences or information may be stored in the cookie, which is then sent back to the server on completion of the session. Cookies may be turned off within your browser, however, this may make some sites or portions of the sites unusable.

Pages on this site may be coded with scripts from Google Analytics. This is transparent to the user, as the software makes use of an invisible image at the bottom of the web page. This software stores a cookie in your browser, which contains a unique identifier, and sends information to Google Analytics. This enables Google Analytics to track the number of unique visitors to this site. In no way does this unique identifier identify a user personally.

For more information, see:

• Google Analytics
• Google Privacy Centre
• Wikipedia page about HTTP cookies

Submissions

At Class Creator we welcome all feedback. We are always interested in ways we can improve our software and develop new solutions. All suggestions, ideas and feedback is welcome, however recipients should be aware that once a submission is made it become the exclusive property of Pigeonhole Software Pty Ltd.

Communication

We reserve the right to communicate with our clients in regards to any promotions of special offers or products that we may reasonably assume are of interest to the client. At anytime clients may request not to receive these communications and their communication preferences will be updated and respected.

Class Creator Application

The Class Creator Application is designed to collect and sort data in regards to the creation of classes in educational institutions. For the software to best fulfil its purpose, we will required personal information of students. We understand that all information collected is sensitive and must be collected, used and stored using best practice standards. Users should also be aware that any information they enter is at their own discretion, and as such they are responsible for the protection of this information.

Information Collection Process

Class Creator aims to collect the minimum amount of information required to provide our “Class Creator Solution”. All information is collected through the use of restricted APIs to ensure access is secure. All users are required to access Class Creator using a unique username and password (login details). Users are responsible for the safety of these login details. Passwords and login details should not be shared with third party non-users of Class Creator. A user will be held liable for any actions taken by their account.

It is not possible to guarantee that any transmission over the internet will be 100% secure. Public computers in particular should never be considered secure. You should never give out personal information on message boards, in chat rooms, and other publicly viewable locations. Any online activities are at the discretion of, and the responsibility of, the individual user.

There are inherent risks associated with the transmission of personal information via the internet as it is not a secure medium. Class Creator has made every effort to implement security policies, rules and measures to protect your information from unauthorised access, improper use, alteration and destruction.

Type of Information Collected

In order to successfully produce optimal results, Class Creator will request specific information from users. All data provided is at the school’s and user’s discretion. Pigeonhole Software Pty Ltd takes no responsibility for the content uploaded by our users. If users are misusing our software we have the right to suspend or remove access at any time. We recommend clients keep backup copies of any data shared with Class Creator. We take measures to ensure that personal information is accurate, complete and up to date. We do not record national unique identifiers, including tax file numbers. However we do require individual student identification numbers to accommodate the Class Creation process. Schools may wish to inform parents or guardians that students will be entering social preferences (if applicable to the school) into the Class Creator database.

Class Creator will require specific information about a school in order to create a secure Administrator Account and to request payment for services. Such information includes, but is not limited to the following:

• Administrator Name
• Administrator Contact Details
• School Name
• School Contact Details
• Number of students at the school

School Administrators will be requested to upload student and teacher information to create individual user accounts, usernames and passwords, and to customise the Class Creator solution to fit their school’s needs. Such information includes, but is not limited to the following:

• Student/Teacher Name
• Student/Teacher Gender
• Student/Teacher Current Class
• Student/Teacher Current Year Level
• Teacher Email Address
• Student Identification Number

Users of Class Creator are comprised of educators, schools, and/or school district offices. Users will have to opportunity to input specific information in regards to their students, to assist in creating classes. All information entered is at the discretion of the user. Information provided may include, but not be limited to, the user’s assessment of a student’s behaviour, academic level, special needs, school history and social needs. The user may also provide any additional information they feel would assist in producing better classes and/or outcomes.

Users will have the to opportunity to allow students to input data to assist in the creation of classes. There are inherent risks associated with the transmission of personal information via the internet as it is not a secure medium. Do not provide any secure personal information online such as a password or credit card number or information that you wish to keep confidential.

We do not create or keep student profiles for non-educational purposes.

Password and Login

Class Creator is a private computing system. Access is granted to the system only via users inputting a unique username and password. Unauthorised or improper access to the system may result in immediate suspension or revoking of access. We may take civil and/or criminal action against anyone in breach of our Terms and Conditions policy. Do not login if you do not agree to the terms and conditions. Do not share your username and/or password with anyone. If you do share your username and/or password you will be held liable for any activity on your account and you will be in breach of our agreement.

All logins to our website and application, record information including IP addresses, browser types and in some cases geographical information.

Information Secure Storage

We take reasonable steps to protect personal and health information from misuse, loss, unauthorised access, modification and disclosure. Class Creator stores data on Microsoft Azure. Data for Australian and New Zealand users is securely stored in Australia, while data for all other regions is hosted in the United States. Azure is one of only four Cloud Services certified by the Australian Signals Directorate (ASD) to provide cloud based services to the Australian Government.

Microsoft has decades-long experience building enterprise software and running some of the largest online services in the world. It has leveraged this experience to implement and continuously improve security-aware software development, operational management, and threat mitigation practices that are essential to the strong protection of data in the cloud.

Security is built into Azure from the ground up, starting with the Secure Development Lifecycle, a mandatory development process that embeds security requirements into every phase of the development process. Azure infrastructure is resilient to attack by mandating that operational activities follow the rigorous security guidelines laid out in the Operational Security Assurance (OSA) process. For more information on the storage of data using Azure please visit their website here or contact us directly at Class Creator.

Class Creator regularly conducts penetration and threat modeling to ensure our network is properly secure and up-to-date.

We use the best one-way encryption to store your password (technically known as PBKDF2), and use industry leading cryptography to ensure data remains secure and confidential from our servers to you (using AES_128_GCM and uses ECDHE_ECDSA as the key exchange mechanism).

In the rare and unlikely event that there is unauthorised data accessed, Pigeonhole Software will work on containment and, if necessary, inform affected parties as soon as reasonably possible, and within 72 hours.

Use of Information

Class Creator will use the information provided by its users to present a “Class Creator Solution”. Institutions will then have the opportunity to use the classes produced in accordance with this Privacy Policy.

Information provided about a specific student, will become specific attributes of that student. For example, Tim Bowman, Behaviour = Satisfactory Academic= At Level, Special Needs= Nil, Separation= Brad Walker, Pairing= Jack Wilson.

Our algorithm will use those student attributes to sort students into specific classes, depending upon the setting of the sorting algorithm, as determined by the user.

Educators will have the ability to manually manipulate the classes, and have access to the attributes of each individual student. This will be dependent upon the level of access as determined by the school’s administrator. For example, the following access may be granted:

Teacher = Access to only their class’ data

Team Leader = Access to their class’ data + their year levels automatic and manual sorting of new classes.

Administrator = Access to all student and teacher data and all automatic and manual sorting of new classes.

All information will be stored securely for future reference and use by the school, unless notified otherwise. At anytime schools or individuals can request that their personal information be removed

We will only use the information provided to us for the development and monitoring of academic classes.

Disclosure

Certain information that may be provided to Class Creator by teachers, school leaders, teacher aides, or other personnel at an Institution (“School Official”) that is directly related to a student and maintained by an Institution, may be considered an education record (“Education Record”) under the Family Educational Rights and Privacy Act (“FERPA”). Additionally, certain information, provided to Class Creator by School Officials about a student, such as student name and grade level, may be considered directory information under FERPA (“Directory Information”) and thus not an Education Record. A school may not generally disclose personally identifiable information from an eligible student’s education records to a third party without written consent of the parent and/or eligible student or without meeting one of the exemptions set forth in FERPA (“FERPA Exemption(s)”), including the exemption for Directory Information (“Directory Information Exemption”) or disclosure to school officials with a legitimate educational interest (“School Official Exemption”).

We will never sell or release any student’s personally identifiable information for any purpose.

As a School Official or Institution providing Directory Information or any Education Record to Class Creator, you represent, warrant and covenant to Class Creator, as applicable, that your Institution has:

• (i) complied with the Directory Information Exemption, including, without limitation, informing parents and eligible students what information the Institution deems to be directory information and allowing parents and eligible students a reasonable amount of time to request that schools not disclose directory information about them; and/or
• (ii) complied with the School Official Exemption, including without limitation, informing parents in their annual notification of FERPA rights that the Institution defines “school official” to include service providers and defines “legitimate educational interest” to include services such as the type provided by Class Creator; or
• (iii) obtained all necessary parental or eligible student written consent to share the Directory Information and Educational Records with Class Creator, in each case, solely to enable Class Creator’s operation of its service.

Class Creator will never share Education Records with third parties as stated in our Privacy Policy. Education Records are never used or disclosed for third party advertising or any kind of first- or third-party behaviourally-targeted advertising to students or parents. Additionally, it is never used or disclosed for third party advertising, or any kind of first- or third-party behaviourally-targeted advertising, and personal information collected from a student is never sold or rented to anyone.

Class Creator may use Education records that have been de-identified for product development, research or other purposes (“De-Identified Data”). De-Identified Data will have all direct and indirect personal identifiers removed; this includes, but is not limited to, name, date of birth, demographic information, location information and school identity. Class Creator agrees not to attempt to re-identify the De-Identified Data and not to transfer the De-Identified Data to a third party unless that party agrees not to attempt re-identification.

Class Creator will not disclose your personal information to a third parties without your consent, unless we are required or authorised to do so by law or other regulation. In the event of an investigation into suspected unlawful or improper activity, a law enforcement agency or government agency may exercise its legal authority to inspect the web server’s records (e.g., in relation to hacking or abusive messages).

Student information collected on Class Creator is never used or disclosed for third party advertising targeted at students or parents.

We will never sell or release any student’s personally identifiable information for any commercial or marketing purposes

All student data belongs to the relevant educational institution (district, state or national). We do not own any student data collected in the process of using Class Creator.

School and individual data sets may be stripped of all personal and institutional unique identifiers and stored for academic research into how class compositions affect educational outcomes. The objective of this study is to improve the outcomes for all educational institutions.

Your Rights

As part of the class creation process we are required to collect personal information. This information is accessible to users. Therefore we would encourage any individuals (students or families) to contact the relevant user (school or district office) directly to access any relevant data.

We will not retain student personal information for longer than necessary to deliver services or for school purposes. Personal information will not be kept in backups.

However, individuals may also request access to their data from Pigeonhole Software Pty Ltd, in regards to Class Creator. Individuals may request to see, correct, delete or amend their personal information. All requests for personal information will be processed as quickly possible, usually within 30 days of the request.

Data will not be shared with a third party unless it is agreed upon by both Class Creator, the User, and the third party. For example, if a student changes schools, both schools may agree to share data.

Access may be refused in a number of circumstances such as: where the sharing of information may result in placing another party in danger; where the information related to existing or anticipated legal proceedings; or where required by law.

Our Staff

Staff at Class Creator understand the sensitivity of the data used in the class creation process. We have strict staff confidentiality agreements in place and our staff are either registered with the relevant body (e.g., VIT) or have a Working With Children Check. Our staff are kept up to date on “best practice” within our industry and regards to data security. If you wish to provide feedback on our staff please do so via our contact us page.

Enforcement

If for some reason you believe Class Creator has not adhered to the principles of this Privacy Policy, please notify us, and we will do our best to determine and correct the problem promptly.

1. Limitations of Warranties and Remedies.

To the full extent allowed by law, Class Creator disclaims all warranties, terms or conditions, express or implied, either in fact or by operation of law, statutory or otherwise, including warranties, terms, or conditions of merchantability, fitness for a particular purpose, and warranty of noninfringement. Class Creator neither assumes nor authorizes any other person to assume for it any other liability in connection with the sale and use of the products and services. Class Creator’s liability will not exceed the fee paid by the customer for the purchase of the products. In no event will Class Creator be liable for any incidental, consequential, punitive or special damages, including, without limitation, lost profits or revenues, even if Class Creator has, or should have had, any knowledge, actual or constructive, of the possibility of such damages.

Certain jurisdictions do not allow limitations on implied warranties or the exclusion limitation of certain damages. If you reside in such a jurisdiction, some or all of the above disclaimers, exclusions, or limitations may not apply to you.

2. Indemnification.

Each of the parties acknowledges and agrees that by entering into and performing its obligations under this Privacy Policy, Class Creator will not assume and should not be exposed to the business and operational risks associated with your business. You agree to defend, indemnify, and hold harmless Class Creator and its officers and employees against any and all third party claims, suits, costs, losses, liabilities, and expenses of any kind (including reasonable attorneys’ fees) that Class Creator may incur arising out of or resulting from the use of the website and/or software or any of the goods and services of Class Creator, the end user, or any other person. This provision applies so far as permitted by the relevant state law where the user resides.

3. Governing law and jurisdiction.

This Privacy Policy will be construed and governed in accordance with the laws of Victoria, Australia without application of choice-of-law provisions that would require application of the laws of another jurisdiction. By entering into this agreement, all parties irrevocably submit themselves to the exclusive jurisdiction of the state and federal courts in Victoria, Australia with regard to any dispute relating to this Privacy Policy or its enforcement.

4. Severability.

If any provision of this agreement is found to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of any of the remaining provisions will not in any way be affected or impaired and a valid, legal, and enforceable provision of similar intent and economic impact will be substituted therefore.

5. Additional Provisions Regarding Liability.

The parties agree that the foregoing limitations will not be read so as to limit any liability to an extent that would not be permitted under applicable law and specifically will not limit any liability for gross negligence, intentional tortious or unlawful conduct, or damages for strict liability that may not be limited by law.

6. Notices.

Any notices or other communication required or permitted to be made or given by either party pursuant to this Privacy Policy will be in writing, in English, and will be deemed to have been duly given when delivered if delivered personally or sent by recognised overnight express courier, to the address specified herein or such other address as Class Creator may specify in writing.

Additional Information

1. Links.

Class Creator may contain links to other sites. However, please be aware that Class Creator is not responsible for and cannot control the privacy policies of such other sites. We encourage you to be aware when you leave the Class Creator website, and to read the privacy statements of each and every website that collects personally identifiable information. This Privacy Policy applies solely to information collected by Class Creator.

2. Notification of Privacy Policy Changes.

We reserve the right to change this Privacy Policy at any time, and you may visit this page to learn of our revised Privacy Policy. All such changes shall be binding on you 14 calendar days after they are initially posted on the website unless you are a new user, in which case they are binding on you immediately.

We reserve the right to change this Privacy Policy at any time. In which case users will be notified via email and a banner on the login page which will link to the updated policy, notify users of the changes and require updated consent.

3. Business Transition.

In the event we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of our assets, your personally identifiable information will likely be among the assets transferred. We will contract with future companies that are consistent with Student Privacy Pledge principles or allow users a choice to send information to the future entity.

4. Sub-processors include:

Microsoft Azure – Hosting and Infrastructure | Customer Personal Data, created by customer and stored in Applicable Cloud Products.

Zoho – CRM | Customer Personal Data, created by customer and stored in Applicable Cloud Products.

Groove – Support Tool | Customer Personal Data created by customer if shared with Class Creator via attachments in support tickets.

Loom – Support Tool | Customer Personal Data created by customer shared during Loom support communications.

Xero – Finance | Customer Personal Data, created by customer and stored in Applicable Cloud Products.

SendGrid – Messaging Service | Customer Personal Data, created by customer and stored in Applicable Cloud Products.

Hubspot – Marketing Tool | Customer Personal Data, created by customer and stored in Applicable Cloud Products.

WordPress – Website | Customer Personal Data, created by customer and stored in Applicable Cloud Products.

Complaints, Questions or Request

If you are concerned that Class Creator has not complied with your rights, if you have any questions not covered in this policy or if you have any requests please contact us here or at the address below. You may also decide to make a complaint with the relevant privacy regulator.