Introduction

ClassBuddy ("we", "our", or "us") is committed to protecting the privacy of all users ("you" or "your") of our ClassBuddy application ("App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App, which is designed to facilitate communication and information sharing between schools, teachers, parents, and students.

This policy is written to meet or exceed the requirements of major international data protection frameworks, including the General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the US Children's Online Privacy Protection Act (COPPA), India's Digital Personal Data Protection Act (DPDPA), and other applicable laws in the jurisdictions where we operate.

Please read this Privacy Policy carefully. If you do not agree with its terms, please do not access the App.

Information We Collect

We collect information that you or your school provides directly to us when using the App:

School Administrators:

School information

Teacher information (name, age, contact details, subjects taught)

Student information (name, age, grade, class, and any other information provided by parents and collected by the school)

Student contact information (parent/guardian names and contact details)

Class and schedule information

Teachers:

Personal information (name, age, contact details)

Class and schedule information for assigned classes

Parents:

Personal information (name, contact details)

Information about their children (name, age, grade, class)

Students:

Personal information (name, age, grade, class, and any other information provided by parents and collected by the school)

Academic information related to classes and schedules

Automatically Collected Information:

Device information (device type, operating system, unique device identifiers)

Usage data (pages visited, features used, time spent in the App)

Log data (IP address, browser type, access times)

Cookies and similar tracking technologies (see the Cookies section below)

Lawful Basis for Processing

Where required by applicable law (including GDPR and UK GDPR), we process your personal information on the following legal bases:

Contract performance: Processing necessary to provide the App and fulfil our agreement with schools and users.

Consent: Where you or your school has given explicit consent, including parental consent for the processing of children's data.

Legal obligation: Where we are required to process data to comply with applicable laws.

Legitimate interests: For purposes such as improving the App, ensuring security, and preventing fraud — where these interests are not overridden by your data protection rights.

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our App

Facilitate communication between schools, teachers, parents, and students

Manage class and schedule information

Send technical notices, updates, security alerts, and support messages

Respond to comments, questions, and customer service requests

Communicate with you about products, services, offers, and events offered by ClassBuddy

Comply with legal obligations and enforce our Terms and Conditions

We will only use your personal information for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason compatible with the original purpose.

Disclosure of Your Information

We may share information we have collected in certain situations:

With school administrators, teachers, parents, and students as necessary for the functioning of the App

With third-party service providers who process data on our behalf (see Third-Party Service Providers below)

If required to do so by law or in response to valid requests by public authorities (e.g. a court or government agency)

If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of ClassBuddy, our customers, or others

In connection with a merger, acquisition, or sale of all or part of our assets, in which case we will notify you before your data is transferred

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

Third-Party Service Providers

We use the following third-party services to operate the App. These providers act as data processors on our behalf and are bound by contractual obligations to protect your data:

Google Firebase (Google LLC, USA) — Authentication and related app services. Data may be stored on servers located in the United States and other countries where Google operates data centres.

Amazon Web Services (Amazon.com, Inc., USA) — Cloud hosting and database storage. Data may be stored on servers located in the United States and other countries where AWS operates data centres.

Google Tag Manager (Google LLC, USA) — Website analytics and tag management. See the Cookies section for more detail.

We take reasonable steps to ensure that our service providers implement appropriate technical and organisational security measures to protect your data.

Cross-Border Data Transfers

Your personal information may be transferred to and stored on servers located outside your country of residence, including in the United States, where our primary service providers (Google Firebase) operate.

Where we transfer personal data from the European Economic Area (EEA), the United Kingdom, or other jurisdictions with data transfer restrictions, we ensure that appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO

Adequacy decisions where the destination country has been recognised as providing an adequate level of data protection

Other lawful transfer mechanisms as required by applicable law

By using the App, you acknowledge that your data may be transferred internationally as described above.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the App. The types of cookies we use include:

Essential cookies: Required for the App to function. These cannot be disabled.

Analytics cookies: Used via Google Tag Manager to understand how users interact with the App. This data is aggregated and anonymised where possible.

Where required by law (including in the EU, UK, and Canada), we will obtain your consent before placing non-essential cookies on your device. You can manage or withdraw your consent at any time through your browser settings or our cookie preference centre.

To opt out of Google Analytics tracking, you may use the Google Analytics Opt-out Browser Add-on.

Data Retention

We retain personal information only for as long as necessary to provide our services and fulfil the purposes described in this policy, unless a longer retention period is required by law.

Account and profile data is retained for the duration of the active account. Upon account closure or school subscription termination, personal data is deleted or anonymised within 90 days, except where retention is required by law.

Student data is subject to the same 90-day deletion timeline following account closure, unless the school requests earlier deletion or applicable law requires otherwise.

Log and usage data may be retained for up to 12 months for security and operational purposes.

Security of Your Information

We use administrative, technical, and physical security measures to protect your personal information, including encryption in transit and at rest, access controls, and regular security assessments. While we have taken reasonable steps to secure the information you provide, please be aware that no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against interception or misuse.

Children's Privacy and Data Protection

The protection of children's data is a core commitment of ClassBuddy. Our App is used in educational settings and processes data relating to students of all age groups. We apply the strictest applicable standards globally to all children's data.

Parental Consent

We do not knowingly collect personal information directly from children. All student data is entered by schools or parents acting on behalf of the child. Schools using our App are responsible for obtaining appropriate parental or guardian consent before adding student data to the platform, in accordance with the laws of their jurisdiction. This includes:

Verifiable parental consent for children under 13 (as required by COPPA in the United States)

Parental consent for children under 16 (as required by GDPR in the European Union and UK GDPR in the United Kingdom; some EU member states apply age 13)

Parental consent for children under 14 (as required by South Korea's PIPA)

Parental consent for children under 18 (as required by India's Digital Personal Data Protection Act)

If we become aware that a child's data has been collected without appropriate parental consent, we will take steps to delete that data promptly.

Limitations on Use of Children's Data

We collect only the minimum data necessary to operate the App for educational purposes.

We do not use children's data for advertising, marketing, or behavioural profiling.

Access to children's data is strictly limited to authorised users: school administrators, relevant teachers, and the child's own parents or guardians.

Children's data is not shared with third parties except as necessary to operate the App or as required by law.

We do not condition a child's use of the App on the provision of more personal information than is reasonably necessary.

Parental Rights

Parents and guardians have the right to review the personal information we hold about their child, request corrections, restrict processing, or request deletion of their child's data. To exercise these rights, please contact us using the details in the Contact Us section.

UK Children's Code

In accordance with the UK Age Appropriate Design Code, we apply high privacy settings by default for child users, do not profile children without explicit parental consent, and do not use geolocation data for children without active opt-in.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to access: Request a copy of the personal information we hold about you.
• Right to correction: Request that inaccurate or incomplete information be corrected.
• Right to erasure: Request deletion of your personal information where there is no compelling reason for us to continue processing it.
• Right to restriction: Request that we limit the processing of your personal information in certain circumstances.
• Right to data portability: Request a copy of your data in a structured, machine-readable format to transfer to another provider (where technically feasible).
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: Lodge a complaint with the data protection supervisory authority in your country.

We will respond to all legitimate requests within 30 days. In complex cases we may extend this by a further 60 days, and we will notify you of any extension within the initial 30-day period.

To exercise any of these rights, please contact us at info@classbuddy.io.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority as required by applicable law (within 72 hours where required by GDPR/UK GDPR). Where the breach is likely to result in a high risk to affected individuals, we will notify those individuals without undue delay, providing details of the breach and the steps we are taking to address it.

Automated Decision-Making

We do not make decisions about you solely based on automated processing that produce legal or similarly significant effects. If this changes in the future, we will update this policy and provide you with the right to request human review of any such decision.

Compliance with Applicable Data Protection Laws

We are committed to processing personal information in accordance with applicable data protection laws in all jurisdictions where we operate. Our practices are designed to meet or exceed the standards set by major international frameworks including GDPR, UK GDPR, COPPA, India's DPDPA, South Africa's POPIA, Singapore's PDPA, Australia's Privacy Act, South Korea's PIPA, and other applicable local laws.

By using the App, you consent to our Privacy Policy and agree to its terms.

California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

In the past 12 months we have collected the following categories: identifiers (name, email, IP address); personal records (contact details, school affiliation); internet or network activity (usage data, log data); education information (grade, class, schedule).

Your California Rights

Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom we share it.

Right to delete: Request deletion of your personal information, subject to certain exceptions.

Right to correct: Request correction of inaccurate personal information.

Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising. You do not need to opt out, but you may contact us to confirm this.

Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your California rights, contact us at info@classbuddy.io or visit our Contact Us page. We will respond within 45 days.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date below. For significant changes, we will provide additional notice (such as an in-app notification or email). Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.

Data Protection Officer

We have appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection laws. To contact our DPO or to exercise any of your rights, please reach out at:

ClassBuddy
Data Protection Officer
Asla Park
21 Conradie Crescent, Strand
7140
South Africa
Email: info@classbuddy.io

Contact Us

For general questions or comments about this Privacy Policy, please contact us at:

ClassBuddy
Asla Park
21 Conradie Crescent, Strand
7140
South Africa
Email: info@classbuddy.io