Source: https://www.classlink.com/privacy
Timestamp: 2019-04-22 04:33:47+00:00

Document:
ClassLink is committed to ensuring that your information is secure and your privacy is protected. The information below outlines our privacy and security policies. Additional information is contained in our software license and service level agreements. In order to prevent unauthorized access or disclosure, we have put in place physical, electronic and managerial procedures to safeguard and secure the information we store. Learn more about our security protocols.
Data Ownership: ClassLink acknowledges that all personally identifiable information (PII) about students, teachers, administrators, and parents is the property of the educational agencies ClassLink serves.
Purpose: ClassLink is a trusted steward of personal data. Data received from educational agencies is to be used solely for purposes of providing educational services. Such data will not be sold or used for marketing purposes.
Type of Data Maintained in ClassLink: ClassLink maintains personal data needed for the satisfactory operation of the ClassLink system. This data includes what is generally regarded as Directory Information such as name, school building affiliation, grade level, and email address. ClassLink may also maintain profile pictures, cell phone numbers for students age 13+ (to send password reset verification codes), student ID numbers, login credentials for various online resources, and personal computer files (temporarily cached for file transfers between cloud drives and stored until deleted by user for the ClassLink cloud drive). ClassLink does not generally maintain information such as mailing address, gender, date of birth, and other personal demographic data.
Protection: ClassLink keeps all personal data confidential and secure. ClassLink team members are bound by contractual non-disclosure agreements. ClassLink’s data security protections include: internal data management policies and procedures, limitations on access to personal data, data encryption (for both data in transit and at rest), data systems monitoring, incident response plans, and safeguards to ensure personal data is not accessed by unauthorized persons when transmitted over communication networks.
Disposal of Data: ClassLink permanently deletes personal data after the termination of a contract, when no longer needed, or when advised to do so by the educational agency.
Correction: ClassLink enables users, or their authorized parents, to review personal information maintained in ClassLink and correct erroneous information.
Discovery of a security breach that results in unauthorized release of personal data: ClassLink shall promptly notify affected educational agencies of such breach, shall conduct an investigation, and shall restore the integrity of its data systems as soon as possible. ClassLink will fully cooperate and assist with required notices to those individuals affected by such breach.
Financial Protection: ClassLink shall maintain business insurance policies to protect the educational agencies it serves.
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA sets forth protocols for ensuring privacy and security of personally identifiable information of students. ClassLink adheres to the data protection protocols set forth in FERPA.
ClassLink is iKeepSafe Certified: The iKeepSafe FERPA Certification demonstrates compliance with the federal mandates as well as iKeepSafe’s rigorous guidelines through the published Product Profile.
ClassLink is compliant with the regulations put forth by the Children’s Online Privacy Protection Act (COPPA). ClassLink maintains and protects only that information which enables users to operate ClassLink services.
ClassLink is iKeepSafe Certified: The iKeepSafe COPPA Safe Harbor Certification program ensures that practices surrounding collection, use, maintenance and disclosure of personal information from children under the age of 13 are consistent with principles and requirements of the Children’s Online Privacy Protection Act (COPPA). Companies that comply with the guidelines are awarded a badge, making it easy for parents and schools to identify products that are compliant with COPPA.
Although ClassLink does not itself prevent access to inappropriate websites, that burden belongs to the school or library, ClassLink can help create an intentional internet experience for young students by enabling instant access to positive online resources from any device.
ClassLink is compliant with the web content accessibility guidelines of WCAG 2.0 Level AA as accepted by Section 508 of the Rehabilitation Act of 1973, and the Americans with Disabilities Act (ADA).
GDPR is the newest body of regulation regarding the handling of personal data for citizens of the European Union (EU). The primary objective of the GDPR is to give citizens control of their personal data. Select ClassLink products are compliant with the EU General Data Protection Regulation.
GDPR includes 11 chapters and nearly 100 articles. Below are some of the most relevant articles.
Article 5 “Principles relating to processing of personal data”: ClassLink is a trusted steward of personal data. Data received from educational agencies is to be used solely for purposes of providing educational services. Such data will not be sold or used for marketing purposes.
Article 17 “Right to be forgotten”: Schools can choose to delete users from ClassLink at any time. Individual users can choose to delete any data they’ve added to ClassLink at any time. ClassLink promptly deletes data associated with schools no longer working with ClassLink.
Article 32 “Security of processing”: ClassLink keeps all personal data confidential and secure. ClassLink team members are bound by contractual non-disclosure agreements. ClassLink’s data security protections include: internal data management policies and procedures, limitations on access to personal data, data encryption (for both data in transit and at rest), data systems monitoring, incident response plans, and safeguards to ensure personal data is not accessed by unauthorized persons when transmitted over communication networks.
Article 33 “Notification of a personal data breach to the supervisory authority”: GDPR requires notice to the supervisory authority within 72 hours of awareness of a personal data breach. Discovery of a security breach that results in an unauthorized release of personal data: ClassLink shall promptly notify affected educational agencies of such breach, shall conduct an investigation, and shall restore the integrity of its data systems as soon as possible. ClassLink will fully cooperate and assist with required notices to those individuals affected by such breach.
Article 35: “Data protection impact assessment”: ClassLink conducts various security assessments of our systems. Certain security tests are conducted annually, others more frequently and some other tests are running constantly.
Article 37: “Designation of a data protection officer”: ClassLink maintains a designated data protection officer who is authorized to engage security reviews and impact product development.
Article 44: “General principle for transfers”: To promote data sovereignty/data residency in GDPR, the regulation authorizes the European Commission to decide if a third country or territory, where data may be transferred, meets adequate levels of protection. As GDPR is new, no third country or territory has yet been approved by the Commission. ClassLink customers located in the EU or UK are assigned to a data center based in the EU (Frankfurt, Germany). This EU data center maintains all needed ClassLink application and data servers and no server outside of that datacenter is used to store data or deliver services to EU or UK based customers.
The CSPC builds on iKeepSafe’s FERPA Assessment and COPPA Safe Harbor, which help educators and parents find products that meet the expectations of federal privacy laws. This certification is recommended for operators and providers of websites and online services that are, whole or in part, intended for use in and by schools. Earning the iKeepSafe CSPC asserts that your technology company is a leader in student privacy.
Location: ClassLink contracts with educational agencies in California are governed by and construed in accordance with the laws of the State of California. Additionally, educational agencies in the United States are serviced by ClassLink servers and database infrastructure that are based in the United States.
ClassLink is compliant with the regulations put forth by § 10-234aa through § 10-234dd, An Act Concerning Student Data Privacy.
Location: ClassLink contracts with educational agencies in Connecticut are governed by and construed in accordance with the laws of the State of Connecticut. Additionally, educational agencies in the United States are serviced by ClassLink servers and database infrastructure that are based in the United States.
ClassLink is compliant with the regulations put forth by Fla. Stat. § 1002.22, Education records and reports of K-12 students; rights of parents and students; notification; penalty (§1002.22); and Fla. Stat. § 1002.222, Limitations on collection of information and disclosure of confidential and exempt student records (§1002.222).
Biometric data of students, parents, and siblings: ClassLink does not collect biometric information as defined statute for students, parents, and siblings in Florida.
Location: ClassLink contracts with educational agencies in Florida are governed by and construed in accordance with the laws of the State of Florida. Additionally, educational agencies in the United States are serviced by ClassLink servers and database infrastructure that are based in the United States.
ClassLink is compliant with the regulations put forth by the Education Law §2-d and the Personal Privacy Protection Law (PPPL), Article 6-A of the Public Officers Law.
Location: ClassLink contracts with educational agencies in New York are governed by and construed in accordance with the laws of the State of New York. Additionally, educational agencies in the United States are serviced by ClassLink servers and database infrastructure that are based in the United States.
Parents’ Bill of Rights: ClassLink includes the Parents’ Bill of Rights is included with every ClassLink contract in New York State.
Our ClassLink system and company website contain links to other websites. Once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

References: § 1232
 § 10
 § 10
 § 1002
 § 1002
 §2