Privacy Policy

EDIFII US, LLC dba 21stCentEd

PRIVACY POLICY

EFFECTIVE DATE: January 19, 2024

LAST UPDATED: January 19, 2024

EDIFII US, LLC dba 21stCentEd (“21stCentEd”) understands that privacy is tremendously important to our clients and visitors to our website. 21stCentEd recognizes the need to protect personally identifiable student information and other regulated data exchanged between our clients and us. This Privacy Policy addresses the privacy protections of 21stCentEd as required by applicable laws and regulations, such as the Family Educational Rights and Privacy Act (“FERPA”) at 20 U.S.C. § 1232g (34 CFR Part 99); the Children’s Online Privacy Protection Act (“COPPA”) at 15 U.S.C. § 6501-6506 (16 CFR Part 312); and applicable state privacy laws and regulations. 21stCentEd pledges to fully adhere to our obligations and duties in order to comply with applicable data privacy and protection laws and regulations.

Thank you for visiting this website, application or other digital platform. This Privacy Policy applies to all Sites, applications and other digital platforms (collectively, the “Sites”) linking to it and operated by 21stCentEd or any one of its affiliates.

This Site is one of a network of Sites operated by 21stCentEd (each a “21stCentEd Affiliate Site” and, collectively, the 21stCentEd Network of Sites “Sites”). Each 21stCentEd Affiliate Site has adopted this Privacy Policy to the extent applicable and/or unless otherwise indicated. “Affiliate” means a company controlling, controlled by or under common control with another company, or a company which shares common management.

This Privacy Policy is provided by 21stCentEd that operates this Site to explain the ways in which we collect personal information from you through your use of this Site and any of our applications or other Sites (collectively, the “Service”), and the ways that we (and other 21stCentEd Affiliate Sites, as applicable) may use that personal information. We may share any of the information that we collect from you (including anonymous information and personal information that you may provide) with the other 21stCentEd Affiliate Sites within the 21stCentEd Network of Sites so that we and they can provide you with products and services that may be of interest to you.

This 21stCentEd Privacy Policy (“Privacy Policy”) applies to our website, https://21stcenturyed.com, and any 21stCentEd Affiliate Site to include www.21stcented.matrixlms.com in the context of the provision of the Services provided to our clients (collectively “Sites”, “we”, “us” or “our”) whether the platforms are accessed through a Website or a direct log-in to a mobile application, and that link to this Policy.

Please read this Privacy Policy carefully so that you understand our online privacy practices. By using our Services, you acknowledge that your use, and any dispute over our online privacy practices, is governed by this Privacy Policy and our Terms of Service. If you have any questions regarding web privacy, please contact us privacy@21stcenturyed.com.

WHO WE ARE

EDIFII US, LLC dba 21stCentEd (“21stCentEd”), creates and delivers high-quality on-line resources like courses, lessons, and interactive experiences for K-12 education and beyond. The services we offer enable educators and students to participate in enhanced learning experiences.

21stCentEd is a “processor” or “service provider” of our client data, personal data submitted to the Services or collected through the Services on behalf of or at the direction of the Subscriber (the “schools” or “school districts”, Local Education Agency (“LEA”), “parent”, community based organization (“CBO”), who are the “controllers” of the personal data), and personal data we receive or collect from the subscriber. When we are acting as a “processor” or “service provider”, we will only process the personal data on behalf of and subject to the terms of its contract with the subscriber, to the extent such contract exists, unless otherwise required by law. If you have questions about our processing of your personal data on behalf of a subscriber, please refer to the subscriber’s privacy policy.

SCOPE

21stCentEd respects the privacy of our clients and visitors of our Sites; users of our online subscription services, features available on our systems, and digital lessons; participants in our education experiences or challenges; participants of our surveys and research studies; individuals who communicate with us; participants in our educator and leader networks; educators who attend training or Professional Development; and attendees of conferences or other events (collectively, the “Services”), and have developed this Privacy Policy to demonstrate our commitment to protecting your privacy.

In order to deliver our Sites and Services to you, from time to time we collect personal information. This Privacy Policy explains how we collect, disclose, use, and protect information when you visit or use our Sites and Services. This Policy should be read in conjunction with other relevant privacy or data protection notices provided by 21stCentEd to our clients for your jurisdiction which contain additional information on the Services we provide and the associated use of personal information supplemental to that used on our Sites. We advise you to read the Policy in its entirety, including the jurisdiction-specific provisions, which will apply to users in certain jurisdictions.

What is This Policy?

WE FULLY DESCRIBE OUR PRIVACY PRACTICES BELOW IN THIS PRIVACY POLICY. THIS SUMMARY PROVIDES AN OVERVIEW OF SOME IMPORTANT INFORMATION REGARDING OUR USE AND SHARING OF YOUR INFORMATION, AND THIRD PARTIES WHO MAY SET COOKIES OR WEB BEACONS OR SIMILAR TRACKING TECHNOLOGIES WHEN YOU USE THE SERVICES. PLEASE READ THE ENTIRE PRIVACY POLICY VERY CAREFULLY. BY USING ANY SERVICE, YOU AGREE TO BE BOUND BY THIS PRIVACY POLICY IN ITS ENTIRETY.

Information Collection/How we use your information: We primarily use the information we collect when you use the Services in connection with your relationship with 21stCentEd, your use of the Services, and for sending you information from us.

Information Sharing: Remember that if you create an account or share Personal Information with other users on the Services, your information may be visible to others. However, student data will only be visible to their administrators, teachers and parents, and students cannot share data with other students. Note that we do not share your Personal Information with third parties for their marketing purposes; however, we may share your Personal Information under certain limited circumstances.

Third party analytics providers: We work with analytics service providers and other vendors to provide us with information regarding traffic on our Sites or through our service (collectively referred to as “Sites”), including the pages viewed and the actions users take when visiting the Sites and to provide us with information regarding the use of the Sites.

How Are Accounts Created?

When Subscribers purchase licenses, 21stCentEd creates an organization in the product and grants administrative access to that organization through a primary account. The Subscriber then enrolls students and teachers/administrators into schools and classrooms and creates accounts on their behalf. When the Subscriber creates student accounts, they are acting on behalf of parents to give 21stCentEd permission to collect the information described in this Privacy Policy, and 21stCentEd is acting as a service provider to the Subscriber.

When the primary account belongs to a Subscriber, student accounts will be populated in coordination with that Subscriber. Students will then be provided login information in a manner specific to that district and in accordance with Subscriber’s policy, which may in some cases be through a “single sign-on” or by communicating an initial login and password to the student.

The use of our Sites is contingent on our processing of your Personal Information as set forth in this Privacy Policy. By creating an account and/or using the Sites, you are consenting to such practices. If you do not consent to our processing of your Personal Information as set forth in this Privacy Policy, you should not use our Sites.

Some Services may also allow a LEA to create a parent account tied to a student account if so desired.

Consent

In this Policy, “personal information” means information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, and online identifier or to one or more factors specific to his/her physical, physiological, genetic, mental, economic, cultural, or social identity. Personal information does not include aggregate information or de-identified information.

By disclosing your Personal Information to us when you use the Services, you expressly agree to the personal data protection practices, uses, disclosures, and processing as described in this Policy.

Consent by CBOs, LEAs, Teachers and Parents (Subscriber)

If you are a student of any age, you must get permission from your Subscriber or Subscriber-authorized representative to use the Services.

21stCentEd Services are not offered directly to students on any basis and Subscribers must first sign up for primary accounts, and then invite students, teachers, and parents to use our Sites through the accounts they create. Subscribers that have obtained licenses must provide consent on behalf of students for 21stCentEd to collect and use student data described in this Privacy Policy and opt to allow for student account creation.

Overview of Information We Collect and How We Collect It

We may collect several categories of personal information from or about you, including information:

By which you may be personally identified, including your full name, email address, username, month and year of birth, address, and/or image.
Your grade in school, your month and year of birth, your age, your school name and address, academic performance information, what grade you teach, course name, assignments, your feedback and survey responses on our Sites and Services, professional development, and training (e.g., how you feel about the quality and quantity of lessons, how likely you are to recommend our Sites or Services to others, or how you rate a particular digital lesson), geographic location information (e.g., address, country, state, city and/or postcode), and student-created content.
About your internet connection, the equipment you use to access our Sites and Services and other usage details (e.g., session duration, number of actions per session, feature usage, and whether you complete videos or lessons).

We collect this information:

Directly from you when you provide it to us, such as when you register to use our Sites and Services; register for training, professional development, an experience, challenge, event; participate in a survey or provide feedback; sign up to receive marketing communication and newsletters from us; or when you contact us.
From your school district, school, or a vendor or services provider in order to provide you with access to the Sites and/or Services.
From a colleague who may refer you to us.
From our marketing and research partners who help us connect with educators or conduct research and surveys on our behalf.
Automatically from your device when you access or use our Sites and Services.

What Information Does 21stCentEd Collect About Students, Teachers, and Parents?

Information shared with us: We may collect Personal Information. The information that we collect from logged-in users includes information that you voluntarily provide to us when you use your account and information that is automatically collected when you are logged into 21stCentEd’s Sites. The information collected depends on whether you are a CBO, teacher, LEA, parent, or student and may vary slightly from Service to Service. Below is a list of information collected across all our Services.

Student Account:

Required student information
- Student first and last name
- Student email
- Grade level
- Language
- Student number
- Student username and password for our Services
- LEA name
- Information provided through use of our Services:
  - Assessment results and scores including academic performance and placement, psychographic information, and screening results
  - Curriculum progress
  - Audio recordings
  - Student-generated content (e.g., responses to writing prompts and math journals)
  - Communications (such as chat text logs between students and certified teachers, grade commentary, etc.)
  - Certificates of achievement and curriculum completion
Optional student information (Note that we will never condition a student’s participation in an activity on the student’s disclosure of more Personal Information than is necessary to participate in the activity)
- Single sign-on ID (for schools that use a single sign-on functionality)
- Demographic information (such as date of birth, gender, ethnicity/race, language).
- Special indicators (such as Individual Education Plan (IEP) status, English-Language Learner (ELL) status, living situations (foster care/homeless), low-income status etc.)
- Organization number (e.g., school or district identifier, state identification, or other number)
- Student email

Teacher/Administrator Account:

Teacher/Administrator first and last name
Teacher/Administrator title
Email address
LEA name
State
Teacher/Administrator username and password for our Services
Single sign-on ID (for schools that use a single sign-on functionality)
Certificates of completion for online training

Parent Account (optional):

Parent first and last name
Email address
Parent username and password for our Services

Information received from third parties: Third parties may provide us with information about you. For example, if you are on a third-party website, and opt-in to receive information from us, that third party will forward information to us so that we may contact you as requested. Any personal information received from these third parties will be handled in accordance with this Privacy Policy and our agreements with these parties. We sometimes combine information we receive from third parties with the personal information we collect through the Services. Any such combined information will be treated as Personal Information in accordance with this Privacy Policy.

Information we collect automatically: Like most online services, when you use the Services, we automatically collect and store details of how you used our service, such as your activity , and the frequency and duration of your visits. In every case we also log certain detailed technical information about all users’ interactions with our Services that could be linked with users (including students). This includes the IP addresses that we get when users connect to our Services, information that is sent by web browsers automatically when they connect to our Services (such as the type of web browser, the operating system used and the time zone set on the user’s computer), and the timing and frequency of how users interact with different content and different areas of our Sites.

We use following methods and tools to collect and track the automatically collected information described above:

Cookies: Like many other Sites and apps, we set cookies so that we may recognize when someone connecting to our Sites is currently logged in or has visited before. A cookie is a data file sent to a browser from a web server and stored on the user’s computer’s hard drive that allows us to recognize that browser when the user returns to our Sites. To learn more about browser cookies, including how to manage or delete them, look in the Tools, Help or similar section of your browser, or visit http://www.allaboutcookies.org.
How we respond to Do Not Track signals: Please note that your browser setting may allow you to automatically transmit a “Do Not Track” (DNT) signal to Sites and online service you visit. DNT is a privacy preference users can set in certain web browsers to inform Sites and services that they do not want certain information about their webpage visits collected over time and across Sites or online services. However, we do not recognize or respond to browser-initiated DNT signals, as the internet industry is still working to determine what DNT means, how to comply with DNT, and how to create a common approach to responding to DNT. To find out more about “Do Not Track”, please visit http://www.allaboutdnt.com.

By using our Services, you agree to our use of these information collection technologies.

De-identified and Aggregate Data

We frequently aggregate information in a way that is designed to make it impracticable to use that data to identify a particular person. We also sometimes maintain individual data records with personal identifiers removed in a manner that is impracticable to relink it to any specific individual. In this Privacy Policy, we refer to such data as “De-Identified Data” and do not consider it to be Personal Information. We do not attempt to re-identify information that has been de-identified.

What Student Information Can Other Users See?

When the primary account belongs to a Subscriber, the authorized account administrator designated by the Subscriber can access all information we collect about students that we make available through our Sites and online services. Subscriber-authorized designated administrators can delegate the right to view student information in accordance with Subscriber’s policy. Each authorized teacher within that Subscriber’s organization can see only information relating to students’ participation in classes taught by that teacher (unless granted additional access by the Subscriber account administrator).

Some Services may allow a Subscriber to create a parent account tied to a student account if so desired. Parents may view student information only for the student accounts to which they’ve been linked.

What Does 21stCentEd Do With Personal Information?

We will not share Personal Information we collect in any way not described by this Privacy Policy. Except as noted below, we do not share any Personal Information with third parties for advertising, marketing, or other purposes. There is no third-party advertising on 21stCentEd. We do not amass student profiles except in the furtherance of school purposes. We do not ask or require students to provide information beyond that which is reasonably necessary to provide the Services. Except in limited instances to provide support services under an agreement, we do not share any student login information with any third party, and we do not automatically collect Personal Information from student accounts. Information collected from students is never used or disclosed for any third-party advertising or any kind of behaviorally targeted advertising. We do not market to or survey students; however, students may choose to provide ratings and other feedback about their experience with learning activities. Subscriber staff may be invited to provide feedback about their experiences, but participation is never required. We do collect website usage information through third-party analytics services and anonymized data to help us improve our experiences for students, but such information does not contain Personal Information. We also collect website usage information through third-party analytics services for non-student users to support Service support and development.

We use Personal Information and any other information collected through the website for the following reasons:

to administer the Services;
to improve the quality and types of services that we deliver;
to analyze usage of the Services and the popularity and performance of our Sites;
to communicate with Subscribers by responding to your requests, comments and questions;
to track and assess student development and progress;
to generate reports that allow parents, teachers, and other authorized persons to evaluate student progress, identify students who need intervention, and discover students who can be taught together as a group;
to diagnose technical problems;
to email parents, teachers, and other authorized persons regarding service, technical and other administrative matters. These communications may also include information regarding changes in services, new service offerings and important service-related notices, such as security and fraud notices. Such communications will only be delivered to Subscribers and will never be delivered to student users;
to send users alerts to notify them about pertinent activity on our Services, such as messages from colleagues or upcoming assignments (“Notification Alerts”). These Notification Alerts may be sent to all users of our Services, including students;
to provide useful analyses to users and primary account owners;
to conduct research and analytics to improve our Services and value to you, and to perform research for authorized persons;
to protect 21stCentEd and our users, such as conducting audits or notifying Subscribers of inappropriate or potentially harmful behavior;
for other educational purposes requested and sanctioned by an authorized representative of the Subscriber;
for billing, account management, and other administrative matters;
to comply with a judicial order, subpoena or other legal request; or
as required by applicable law or regulation.

Third Parties

How We Share Information

We use third-party service providers to provide a variety of services, such as assisting us with providing customer support, hosting our Services, providing us with analytics about how people use our Services, assisting us with marketing our Services to Subscribers, sending and tracking responses to email, providing a framework for the delivery of assessment tools and analytics, storing data, providing single sign-on services (where applicable), and helping us identify and track bugs and errors in our Services. Student analytics data are anonymous, but teacher analytics data include teacher name and email address. Third parties we work with are contractually prohibited from using any Personal Information for any purpose other than providing the services we request from them.

When a Subscriber is the primary account holder, we share information with third parties at the direction of the Subscriber, and it is the Subscriber’s responsibility to make such requests in a manner that is consistent with their internal policies and the law. We may also share information that we collect in the following (or comparable) circumstances:

if we believe in good faith that it is necessary to disclose the information under any applicable law or regulation (for example, in response to a court order or a subpoena);
if we believe in good faith that it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person;
to investigate and act upon potential violations of the law or of our terms of service;
to provide information to a claimed owner of intellectual property who claims that content you have provided infringes on their rights;
in response to bankruptcy proceedings;
with teachers (and parents where necessary) so they can see information about their students or children, such as the student’s or child’s name, school affiliation and activity on assignments (including time of activity and any responses to questions, extending to grades for those assignments);
when any user logs into 21stCentEd Website with a third-party account (such as a ClassLink, Clever, Google or other Learning Management System account), that third party will learn that that user has visited a 21stCentEd Website, and that information will be subject to that third party’s privacy policy and practices;
with third-party products specifically configured by Subscribers to interoperate with 21stCentEd;
if the information is De-Identified Data;
with our corporate affiliates, parents, and/or subsidiaries; or
in other circumstances that you expressly consent to.

We will not sell Personal Information to anyone for monetary compensation.

If there are changes to this Privacy Policy in the future, Subscribers may agree to those changes through continued use of the Services or choose to stop using 21stCentEd and we will delete their information and the information about their students.

Third Party Content, Links to Other Websites, and 21stCentEd Content Found Outside the Site

Certain content provided through the Services may be hosted and served by third parties. In addition, our Services include some links to third party websites or content over which 21stCentEd has no control and which are governed by the privacy policies and business practices of those third parties. We are not responsible for the data collection practices on those other websites. We advise you to carefully review those websites’ privacy policies before submitting Personal Information there.

Please also note that 21stCentEd content may be included on web pages and websites that are not associated with us and over which we have no control. These third parties may independently collect data. 21stCentEd is not responsible or liable for the privacy practices or business practices of any third party.

Access through a Mobile Device

If you use our Services through a mobile device or one of our mobile applications, you agree that 21stCentEd may store and use that information for security purposes (for example, for user verification or authentication and to ensure that our APIs are being used appropriately.)

Students may have the option to log in with a QR code from their teacher. Scanning the QR code requires use of a camera. All the processing happens through the Subscriber. No video is transmitted or stored on our servers. Students may be able to record themselves using the device’s microphone during certain educational activities. These recordings are processed and stored on our servers. Permission is obtained prior to access to the device’s camera or microphone.

Children’s Privacy

Protecting the privacy of young children is especially important to 21stCentEd. For that reason, we created certain features designed to help protect Personal Information relating to children who are less than 13 years of age (or higher age if required by applicable law) (“Child Users”).

The Children’s Online Privacy Protection Act (“COPPA”) requires that all online service providers, including 21stCentEd, obtain parental consent before knowingly collecting personally identifiable information from children under the age of 13. 21stCentEd does not knowingly collect nor solicit any personally identifiable information from children under the age of 13 (or the applicable age of consent in local jurisdictions) unless and until the Subscriber has authorized us to collect such information through the provision of the Service to Students on the Subscriber’s behalf. Because 21stCentEd collects and uses Student Data at the direction of and under the control of a Subscriber, 21stCentEd relies on each Subscriber to provide appropriate notice to parents of the Subscriber’s use of 21stCentEd’s third party service providers, and for the Subscriber to provide consent and authorization for 21stCentEd to collect personal information from children under 13, as permitted by the Children’s Online Privacy Protection Act (COPPA) and other applicable data protection laws. All personal information collected from or about a child under 13 is “Student Data” because when 21stCentEd collects personal information from a child on behalf of a Subscriber, the information is considered part of that child’s educational record and is under the direct control of the Subscriber.

Children under the age of 13 are prohibited from using the Services or creating an account unless they are doing so with parental consent or with the consent of an account holder who is providing such consent in compliance with COPPA. If we learn that we have collected personal information from a person under the age of 13 that does not comply with COPPA, we will delete that information in a reasonably prudent amount of time. If you believe that a child under the age of 13 has provided personally identifiable information to us without appropriate consent, please contact us at privacy@21stcenturyed.com.

How does a child register and use the Services?

Child Users cannot obtain a user account without it being created by a Subscriber’s-authorized representative.

What children’s information is visible to others?

No student’s profile is made available or visible to the public through 21stCentEd. If a teacher utilizes certain features on a device in the classroom, other students may be able to view information that is displayed by the teacher in the classroom, but students can’t view each other’s individual student profiles.

Parents: To review your child’s user data, you must request the information from your child’s teacher. Some Services may allow a Subscriber to create a parent account tied to their respective students. In such cases, a parent may access their child’s information through the parent account.

Use of Personal Information Collected from Children

When we collect personal information from children under sixteen years old, we will only use that information for the express purpose for which it was collected. The personal information will not be used for any other purpose.

Sharing of Personal Information Collected from Children

Except as provided in this Section, we do not share personal information collected from children under sixteen years old with any third parties.

We may, however, share a child’s personal information that we have collected from the child’s school district, school or from the child in the following limited instances:

How we use and disclose personal information collected from children

We collect, use and disclose personal information from a Student under 13 for the use and benefit of the Subscriber and for no other commercial purpose.

21stCentEd only shares personal information collected from or about a Student under 13 in a few limited circumstances, described below. We do not rent or sell information for marketing purposes and we will never share or sell a child’s personal information with third parties for marketing purposes.

21stCentEd’s Services may facilitate the account holder’s sharing of Student Data with 21stCentEd’s third parties as authorized and directed by the Subscriber. For example, some elements of our Service enable Subscribers to interact or communicate with parents, students, teachers and to share Student Data with designated 21stCentEd Affiliate Sites for the benefit of the student’s education. 21stCentEd does not facilitate the sharing of any Student Data with 21stCentEd Affiliate Sites on the Service except on behalf of the Subscriber after the Subscriber has authorized a 21stCentEd Affiliate Site to access Student Data through the Service.
Please remember that this Privacy Policy applies to the 21stCentEd Services delivered on its Sites, and not to other services or third-party applications, which have their own privacy policies. Schools should carefully read the privacy practices of each third-party application before agreeing to share Student Data with the third-party application through the Service.
We share information within the Service as needed to perform the Service and/or at the direction of the Subscriber. For example, information including Student Data will be shared between and among authorized Subscriber users such as teachers and school administrators and will be shared with third parties such as specific Developers as directed and authorized by the Subscriber. This sharing will depend on the settings and functionality selected by the Subscriber.
We share information with trusted third-party service providers who perform technology services on our behalf (e.g., web hosting, chat providers, analytics services), but strictly for the purpose of carrying out their work for us. Contractors and service providers who may have access to Student Data in the course of performing their services are subject to confidentiality and data security requirements. These service providers have agreed to maintain the confidentiality, security and integrity of the personal information.
We may be required to share information with law enforcement or other third parties when compelled to do so by court order or other legal process, to comply with statutes or regulations, to enforce our End User Agreement (located on the 21stCentEd website), or if we believe in good faith that the disclosure is necessary to protect our rights, privacy, safety or property and the rights, privacy, safety or property of our employees or others; to protect our operations; and to permit us to pursue available remedies or limit the damages that we may sustain.
We may use information in an aggregated and/or anonymous form that does not reasonably identify an individual or LEA. For example, we may use and share aggregate or anonymized data to study and improve our Service, user functionality, and product offerings.
If we sell, divest or transfer our business, we will not transfer personal information of our customers unless the new owner intends to maintain and provide the Service as a going concern, and provided that the new owner has agreed to data privacy standards no less stringent than our own. In such case we will provide you with notice and an opportunity to opt-out of the transfer of personally identifiable Student Data.

Accessing or Deleting a Child’s Personal Information

Upon written request, we will provide the Subscriber the opportunity to access and review the personal information collected from their students. At any time, a Subscriber can refuse to permit any further collection of a child’s personal information and/or request to delete a child’s personal information. If you are a Parent or legal guardian and you have questions about the personal information collected by 21stCentEd, please discuss your questions with your child’s School.

Please contact us at privacy@21stcenturyed.com if you believe we have inadvertently collected personal information of a child without proper consent so that we may delete such data as soon as possible.

Our Security Practices

We strive to protect the confidentiality, security, and integrity of the Personal Information we collect from children and adults. We have put in place physical, electronic, and administrative procedures designed to safeguard and to help prevent unauthorized access to and maintain the security of personally identifiable information collected through our Services.

All accounts are protected by passwords. Please keep these passwords secret to prevent unauthorized access to these accounts. If you think someone has gained unauthorized access to an account, please change your password and contact us immediately.

We take customary and reasonable measures designed to protect the confidentiality, security, and integrity of Personal Information collected on our Services, both during transmission and within our systems. Such protections include, but are not limited to:

Data encryption and storage: Data is encrypted in transit (SSL/TLS) and at rest. Personal Information is stored and processed within the continental United States.
Access: Access to Personal Information is restricted to a limited number of 21stCentEd employees who need such access to perform their job.
Data Systems Monitoring: We employ several third-party services that continuously monitor and scan our Services for vulnerabilities. Employees dedicated to operating the Services monitor these reports and receive automated alerts when performance falls outside of prescribed norms.
Incident Response Plan: 21stCentEd maintains an incident response plan.
Firewalls: Anti-virus software and firewalls are installed and configured to prevent malicious or unauthorized traffic.
Security audits: 21stCentEd conducts security audits and code reviews, both by external and internal providers.
Employee training: 21stCentEd has designated privacy and data security officials to oversee employee security training and compliance.

How We Protect Your Information

Storage and processing: Any information collected through the Services from U.S. residents is stored in the United States. 21stCentEd maintains strict administrative, technical, and physical procedures to protect information stored in our servers, which are located in the United States. Access to information is limited (through user/password credentials and two factor authentication) to those employees who require it to perform their job functions. We use industry-standard Secure Socket Layer (SSL) encryption technology to safeguard the account registration process and sign-up information. Other security safeguards include but are not limited to data encryption, firewalls, and physical access controls to buildings and files.

Unauthorized disclosure: If there is any disclosure or access to any personally identifiable Student Data by an unauthorized party that compromises the security, confidentiality, or integrity of the Student Data, we will promptly notify the affected Subscriber(s) and will use reasonable efforts to cooperate with their investigation of the incident.

Questions about data? Here are your options.

Data Breach or Security Incident

While we have taken customary and reasonable steps to protect the Personal Information we collect, no system is 100% fail-proof and secure.

In the event that 21stCentEd becomes aware of a data breach impacting your Personal Information, we will provide notification in compliance with all applicable laws and our contracts with Subscribers. For example, we may post a notice on our landing page or elsewhere on our Services and may send an email to you at the email address you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

21stCentEd has procedures in place that are designed to stop threats that may expose Personal Information, restore the Sites to full functionality, and document and take proactive steps to ensure the incident cannot be repeated. 21stCentEd will also preserve necessary evidence for investigation by security professionals and law enforcement as appropriate. In the unlikely event of an unauthorized disclosure of records, 21stCentEd will follow its internal procedures that articulate how to report the problem to internal and external stakeholders. The notification process includes any information that can identify which customers and students may have been impacted, the data that may have been accessed, 21stCentEd’s process to inform affected customers, and steps to prevent the incident from happening again as appropriate.

In the unlikely event of an unauthorized disclosure of Data, 21stCentEd has implemented a process for responding to incidents and notifying affected individuals and, if applicable, law enforcement personnel.

If you have any questions about security on our Services, you can contact us by emailing privacy@21stcenturyed.com directly.

Your Choices Related to Your Privacy

In order to process your information, we rely on your consent or our legitimate interests to process your data. You may withdraw your consent or object to the use of our information at any time, but you may no longer be able to access our Services.

Communications from 21stCentEd

21stCentEd may send you information by email or may post notices on the 21stCentEd homepage: https://21stcenturyed.com.

You may choose to stop receiving certain emails from 21stCentEd by using the unsubscribe button at the bottom of the 21stCentEd email. You may still receive transactional emails from us related to forgotten passwords, account expiration, or other necessary communication. However, we reserve the right to send you information on our behalf and on behalf of third parties in connection with providing our Services. If you no longer want to receive information from us, you will need to close your account.

How You Can Delete or Correct Student Information or an Account

When Subscribers create accounts for students, teachers, and parents, the Subscriber remains the sole owner of the educational data. All requests to review, delete or correct student or teacher information should be directed to the Subscribers. If we receive a request to delete or correct a user’s data from a student, parent, or guardian, we will route such request to the Subscriber and will assist the Subscriber as needed to respond to authorized requests within a reasonable time frame and in compliance with applicable laws and regulations.

If a Subscriber requests deletion of data under the control of the Subscriber, we will promptly delete it, subject to any legal requirement to retain or transfer that data. Note that even following such deletion requests we may store secure backups until they are deleted in accordance with our document retention policy. We may also preserve information as part of an investigation into violations of the law or our terms of use.

Please note that any information you share with others on the website or content other users may have copied is not a part of your account and may not be deleted when you delete your account. If we share your data with one of our service providers, we will use our best efforts to cause such a third party to delete such data when you delete your account.

How We Retain and Delete Your Data

Upon termination of your account, 21stCentEd will take commercially reasonable steps to delete any Personal Information from its live databases in a reasonable amount of time. We will retain Personal Information collected in connection with an account only for as long as is necessary to provide the services to the Subscriber, as required by applicable laws or regulations or otherwise per the terms or a contract with a Subscriber.

Data may be returned to the Subscriber as directed by the agreement with the Subscriber. If no specific instructions are included in the agreement, the data will be returned or destroyed upon one of the following (i) after termination of our relationship with a Subscriber or Subscriber-authorized person, (ii) when it is no longer needed for the purpose for which it was provided, (iii) when advised to do so by the Subscriber, or (iv) as directed by agreement with the Subscriber. Data is returned in a digital, machine-readable format via a secure means of transmission.

We may further retain information for business practices based on our legitimate interest or legal purposes, such as secure electronic archives that are not readily accessible to users or maintained for disaster recovery and/or information technology backups. We may also maintain De-Identified Data, including usage data, for any purpose that is consistent with laws, regulations, and contractual obligations.

Even if your account is closed, information may remain in backup or archive records and we may retain certain data relevant to preventing fraud or future abuse or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable or De-Identified Data, account recovery, or if required by law. All retained data will continue to be subject to the applicable privacy policy for the Service.

Additional Information for Residents in Certain Jurisdictions

We may be required by law to provide additional privacy disclosures, depending on the jurisdiction in which you reside. Please refer below for disclosures that may be applicable to you:

California

In this section, we provide information for California residents as required under California privacy laws, including CCPA, which requires that we provide California residents certain specific information about how we handle their personal information, whether collected online or offline. This section does not address or apply to our handling of:

Publicly available information made lawfully available by state or federal governments;
Personal information we collect about job applicants, independent contractors, or current or former full- time, part-time and temporary employees and staff, officers, directors or owners of 21stCentEd; or
Personal information about individuals acting for or on behalf of another company, to the extent the information relates to our transactions with such company, products or services that we receive from or provide to such company, or associated communications or transactions (except that such individuals have the right to opt-out of any sale of their personal information and to not be subject to any discrimination for exercising such right).

Categories of personal information that we collect and disclose. Our collection, use and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. The Section above titled “Information We Collect and How We Collect It” sets out generally the categories of personal information (as defined by the CCPA) about California residents that we collect, sell, and disclose to others for a business purpose. We collect these categories of personal information from the sources described in the Section above titled “Information We Collect and How We Collect It,” and for the purposes described in the Section above titled “Purposes for Processing Personal Information.”

If you are a California resident, the CCPA grants you certain rights and imposes restrictions on particular business practices as set forth below:

Do-Not-Sell and Do-Not-Share: California residents have the right to opt-out of the sale of their personal information and the sharing of their personal information for purposes of cross-context behavioral advertising. We do not sell personal information.

Limit the Use of Sensitive Personal Information: California residents have the right in certain instances to request that we limit the use and sharing of their sensitive personal information. The CCPA defines “sensitive personal information” to include, among other things, your: social security, driver’s license, state identification card, or passport numbers; account log-in, financial account, debit card, or credit card numbers in combination with any required security or access code, password, or credentials allowing access to an account; racial or ethnic origin, religious or philosophical beliefs, or union membership; genetic data; and biometric information (including physiological, biological, or behavioral characteristics). You may exercise this right by making a request as described in the “Submitting Requests” section below.

Initial Notice: We are required to notify California residents, at or before the point of collection of their personal information, the categories of personal information collected and the purposes for which such information is used.
Request to Delete: California residents have the right to request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies. We will respond to verifiable requests received from California residents as required by law. The instructions for submitting a verifiable Request to Delete are described below.

Request to Know: California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of personal information that we have collected, used, and disclosed about them in the prior 12 months and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance. California residents also have the right to request that we provide them certain information about how we have handled their personal information in the prior 12 months, including the:
- categories of personal information collected;
- categories of sources of personal information;
- business and/or commercial purposes for collecting and selling their personal information;
- categories of third parties with whom we have shared their personal information; and
- categories of personal information disclosed for a business purpose in the preceding 12 months, and for each category identified, the categories of third parties to which we disclosed that particular category of personal information.

California residents may make a Request to Know up to twice every 12 months. We will respond to verifiable requests received from California residents as required by law. The instructions for submitting a verifiable Request to Know are described in the “Submitting Requests” section below.

Request to Correct: California residents have the right to request that we correct inaccurate personal information that we maintain.
Right to Non-Discrimination: The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.
Financial Incentives: A business may offer financial incentives for the collection, sale or deletion of California residents’ personal information, where the incentive is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentive offers and their material terms, the right to opt-out of such incentives at any time, and may not be included in such incentives without their prior informed opt-in consent. We do not offer any such incentives at this time.

Submitting Requests. If you are a California resident and would like to make a request to exercise your rights under the CCPA, please contact us at: privacy@21stcenturyed.com and insert “California Privacy Rights Request” in the subject line. You may also designate an authorized agent to make a request on your behalf by submitting your authorization to us via a verified form of communication, such as through the email address you previously provided to us or previously used to communicate with us. Please allow forty-five (45) days for a response.

We will use the following process to verify Requests to Know, Requests to Delete, and Requests to Correct: We will acknowledge receipt of your request, verify it using processes required by law, then process and respond to your request as required by law. To verify such requests, we may ask you to provide the following information:

For a request to know categories of personal information which we collect, we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you against information in our systems which are considered reasonably reliable for the purposes of verifying a consumer’s identity.
For a request to know specific pieces of personal information or for requests to delete, we will verify your identity to a high degree of certainty by matching at least three pieces of personal information provided by you to personal information maintained in our systems and also by obtaining a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request.

An authorized agent can make a request on a California residents’ behalf by providing a power of attorney valid under California law, or providing: (1) proof that the consumer authorized the agent to do so; (2) verification of their own identity with respect to a right to know categories, right to know specific pieces of personal information, or requests to delete which are outlined above; and (3) direct confirmation that the consumer provided the authorized agent permission to submit the request.

Do Not Track Disclosure:21stCentEd does not support Do Not Track browser settings and does not currently participate in any “Do Not Track” frameworks that would allow us to respond to signals or other mechanisms from you regarding the collection of your personal information.

Virginia

In this section, we provide information for Virginia residents as required under Virginia law, which grants Virginia residents certain rights and imposes restrictions on particular business practices as set forth below.

Right to Access: Virginia residents have the right to confirm whether or not we are processing their personal information and to access such personal information.

Right to Correction: Virginia residents have a right to correct inaccuracies in their personal information, taking into account the nature of the personal information and our purpose for processing their personal information.

Right to Delete: Virginia residents have the right to request the deletion of their personal information that we have collected about them and to have such personal information deleted.

Right to Data Portability: Virginia residents have a right to obtain a copy of their personal information previously provided to us in a portable and, if feasible, readily usable format.

Right to Opt-Out: Virginia residents have a right to opt-out of the processing of their personal information for purposes of (i) targeted advertising; (ii) the sale of personal information; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. Under Virginia law, “sale” means only if we exchange personal information for monetary consideration with a third party.

Right to Non-Discrimination: Under Virginia law, we are prohibited from discriminating against Virginia residents for exercising their rights listed above.

Submitting Requests. If you would like to make a request to exercise your rights, please contact us at: privacy@21stcenturyed.com and insert “Virginia Privacy Rights Request” in the subject line. You may also designate an authorized agent to make a request on your behalf by submitting your authorization to us via a verified form of communication, such as through the email address you previously provided to us or previously used to communicate with us. Please allow forty-five (45) days for a response.

We will use the following process to verify your consumer or privacy rights requests: We will acknowledge receipt of your request, authenticate it using processes required by law, then process and respond to your request as required by law. To authenticate such requests, we may ask you to provide additional information as reasonably necessary.

Utah

In this section, we provide information for Utah residents as required under Utah law, which, beginning on December 31, 2023, grants Utah residents certain rights and imposes obligations on businesses as set forth below.

Right to Know: Utah residents have the right to confirm whether or not we are processing their personal information.

Right to Access: Utah residents have a right to access their personal information that we are processing.

Right to Obtain a Copy: Utah residents have a right to obtain a copy of their personal information that we have collected in a portable and readily usable format, if feasible.

Right to Deletion: Utah residents have a right to request the deletion of their personal information that we have collected about them.
Right to Opt-Out: Utah residents have a right to opt-out of the processing of their personal information for the purposes of targeted advertising and the sale of their personal information. Under Utah law, sale means our exchange of personal information to a third party for monetary consideration.

Right to Non-Discrimination: We are not permitted to discriminate against a Utah resident for exercising one of the above rights.

Submitting Requests. If you would like to make a request to exercise your rights, please contact us at: privacy@21stcenturyed.com and insert “Utah Privacy Rights Request” in the subject line. You may also designate an authorized agent to make a request on your behalf by submitting your authorization to us via a verified form of communication, such as through the email address you previously provided to us or previously used to communicate with us. Please allow forty-five (45) days for a response.

Connecticut

In this section, we provide information for Connecticut residents as required under Connecticut law, which, beginning on July 1, 2023, grants Connecticut residents certain rights and imposes restrictions on particular business practices as set forth below.

Right to Access: Connecticut residents have a right to confirm whether we are processing their personal information and access the personal information we are processing.

Right to Correction: Connecticut residents have a right to correct inaccuracies in their personal information previously provided to us.
Right to Deletion: Connecticut residents have a right to request the deletion of their personal information that we have collected about them.

Right to Data Portability: Connecticut residents have the right to obtain a copy of their personal information that we have collected in a portable format, if technically feasible.
Right to Opt-Out: Connecticut residents have a right to opt-out of the processing of their personal information for the purposes of (i) targeted advertising, (ii) the sale of their personal information, or (iii) profiling in connection with certain automated decisions that produce legal or similarly significant effects. Under Connecticut law, the sale of personal information is the exchange of personal information for monetary or other valuable consideration by the controller to a third party.

Right to Non-Discrimination: We are not permitted to discriminate against a Connecticut resident for exercising one of the above rights.

Submitting Requests. If you would like to make a request to exercise your rights, please contact us at: privacy@21stcenturyed.com and insert “Connecticut Privacy Rights Request” in the subject line. You may also designate an authorized agent to make a request on your behalf by submitting your authorization to us via a verified form of communication, such as through the email address you previously provided to us or previously used to communicate with us. Please allow forty-five (45) days for a response.

Colorado

In this section, we provide information for Colorado residents as required under Colorado law, which, beginning on July 1, 2023, grants Colorado residents certain rights and imposes restrictions on particular business practices as set forth below.

Right to Access: Colorado residents have a right to confirm whether we are processing their personal information and access the personal information we are processing.

Right to Correction: Colorado residents have a right to correct inaccuracies in their personal information previously provided to us.

Right to Deletion: Colorado residents have a right to request the deletion of their personal information that we have collected about them.

Right to Data Portability: Colorado residents have the right to obtain a copy of their personal information that we have collected in a portable format.

Right to Opt-Out: Colorado residents have a right to opt-out of the processing of their personal information for the purposes of (i) targeted advertising, (ii) the sale of their personal information, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. Under Colorado law, sale means our exchange of personal information for monetary or other valuable consideration to a third party.

Right to Non-Discrimination: We are not permitted to discriminate against a Colorado resident for exercising one of the above rights.

Submitting Requests. If you would like to make a request to exercise your rights, please contact us at: privacy@21stcenturyed.com and insert “Colorado Privacy Rights Request” in the subject line. You may also designate an authorized agent to make a request on your behalf by submitting your authorization to us via a verified form of communication, such as through the email address you previously provided to us or previously used to communicate with us. Please allow forty-five (45) days for a response.

Users Outside the United States

Consent to Transfer

The Services are operated in the United States. If you are located outside of the United States, please be aware that information we collect will be transferred to and processed in the United States. By using the Services, or providing us with any information, you fully understand and unambiguously consent to this transfer, processing, and storage of your information in the United States, a jurisdiction in which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen.

Important Information for Users in the European Economic Area

The following information only applies to users in the European Economic Area (EEA), provided that we are the controller of your Personal Information as described below.

Notice of Changes to This Policy

We will occasionally update this Policy to reflect material changes in our privacy practices. If we make any material changes in the way we collect, use, and/or share your personal information, we will notify you by posting the modified Policy on our Sites and Services and indicating at the top of the Policy the date it was last updated. We may also notify you by sending you an email. We encourage you to review the Policy each time you visit one of our Sites and Services to see if this Policy has been updated since your last visit to make sure you understand how your personal information will be processed. Your continued use of the Services after a revision to the Privacy Policy indicates your acceptance and agreement to the current Privacy Policy. We recommend that you periodically review the Privacy Policy to make sure you understand and are up to date on how we are keeping your information safe.

For More Information

If you have any questions or comments regarding our Privacy Policy or our practices, please contact us at privacy@21stcenturyed.com