Privacy Policy

1. About this policy

Awa Education(“we”, “us”, “our”) operates a school management platform for New Zealand kura and schools. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs) set out therein.

By using our service, your school agrees to the practices described in this policy. If you have any questions, contact our Privacy Officer at pipgorrie@gmail.com.

2. Who we collect information about

We collect personal information about:

• School staff (teachers, leadership, administrators)
• Students enrolled at participating schools
• Whānau/parents and caregivers (where school-managed accounts are used)

We act as a data processor on behalf of your school, which is the data controller. Schools are responsible for ensuring they have appropriate authority to share personal information with us under the Privacy Act 2020.

3. What information we collect

Staff information

• Name, email address, role
• Teaching Council registration number and status
• Practising certificate expiry date
• Class assignments and professional goal records (PGC)

Student information

• Name, preferred name, date of birth, gender, ethnicity
• NSN (National Student Number)
• Cultural identity: pepeha, iwi affiliations, Māori immersion level, Pacific language level
• Year level, class enrolment, support level (ORS tier), funding type
• Assessment results and learning progress records (curriculum phases)
• Attendance records
• IEP (Individual Education Plan) data, goals, strategies, and progress notes
• Student voice goals and self-ratings
• Intervention and SENCO notes
• EOTC participation records
• Identity safety flags (e.g. custody orders, name suppression, location restrictions), recorded and visible to authorised staff only

Usage and technical information

• Login timestamps and session data (for security auditing)
• IP addresses (used for rate limiting and security; not stored long-term)
• Application activity logs

4. How we use personal information

We use personal information only for the following purposes:

• Providing and operating the school management platform
• Supporting school staff in tracking student progress, attendance, and wellbeing
• Generating reports and curriculum planning tools for authorised staff
• Sending service-related communications (e.g. invitations, password resets)
• Security monitoring and fraud prevention
• Facilitating whānau-consented cross-school student data transfer via the Learner Passport feature
• Publishing school policies publicly where a school administrator has authorised this
• Complying with our legal obligations

We do not use personal information for advertising, marketing to third parties, or any purpose unrelated to your school’s use of the platform.

4b. Learner Passport, cross-school data flows

The Learner Passport is a feature that allows a student’s learning history to be shared with a receiving school when a student transfers. Because this involves sharing personal information outside the originating school, we describe it separately here.

What data may be included

A Learner Passport may include any combination of the following, selected by the originating school staff and reviewed by whānau before approval:

• Student name, date of birth, NSN
• Cultural identity (pepeha, iwi, ethnicity, language levels)
• Curriculum levels and recent assessment data
• IEP history (as completed historical records)
• Student voice goals
• Support context (ORS tier, funding type)
• Identity safety flags, always included regardless of section selection, to protect the child at the receiving school

Whānau consent and control

• A Passport cannot be accessed by anyone until the student’s whānau has reviewed and approved it
• Whānau may remove sections before approving
• Whānau may revoke the Passport at any time, the access token is immediately invalidated
• Passports expire automatically 30 days after whānau consent

Data sovereignty

The Learner Passport is designed in accordance with Māori data sovereignty principles. Student learning history is treated as taonga belonging to the student and their whānau. The originating school facilitates the Passport but does not control its distribution, that control rests with whānau.

Receiving school responsibility

Once a receiving school imports Passport data, that school becomes the data controller for the imported information under the Privacy Act 2020. Awa Education retains no ongoing responsibility for data after it has been imported by a third school. Imported records are labelled with the originating school name and import timestamp.

5. Artificial Intelligence features

Our platform uses AI-assisted features powered by Anthropic’s Claude API. When you use these features:

• Relevant content is sent to Anthropic’s API to generate responses. The specific data sent depends on the feature used, see the table below.
• Anthropic does not use API data to train its models, data sent via the API is not used for model training by default, per Anthropic’s API usage policy.
• AI-generated content is always presented to staff for review before use. Staff remain responsible for all decisions affecting students.

AI features are disclosed within the application interface wherever they are used. We do not send NSNs, IEP content, dates of birth, addresses, or contact details to the AI API.

6. Third-party sub-processors

We use the following third-party sub-processors to operate the service. All sub-processors are bound by contractual agreements requiring them to protect personal information in accordance with our obligations under the Privacy Act 2020.

7. Data security

• All data is transmitted using TLS 1.2 or higher (TLS 1.3 preferred)
• Passwords are hashed using bcrypt and never stored in plain text
• Access is restricted by role, teachers see only their own class and student data
• School data is isolated per organisation, cross-school data access is only possible via the Learner Passport feature, which requires explicit whānau consent before any data is shared
• Login attempts are rate-limited to protect against brute-force attacks
• Session tokens are invalidated on password reset

8. Data retention

We retain personal information in accordance with the New Zealand Public Records Act 2005 and the Privacy Act 2020:

• Student data: Retained for 7 years after the student leaves the school, then permanently deleted
• Staff data: Retained for 6 years after the staff member leaves the school, then permanently deleted
• School data: Schools can request full export or deletion at any time via the Admin panel. Upon a verified deletion request, all data is deleted within 60 days (except records required to be kept by law)
• Backups: Deleted per our hosting provider’s standard schedule (Supabase retains backups for up to 30 days)

Schools can export all student and staff data as CSV at any time from the Admin panel. The platform provides tools to mark when a student leaves school, starting the 7-year retention clock.

9. Safer Technologies 4 Schools (ST4S)

Awa Education is actively working toward accreditation under the Safer Technologies 4 Schools (ST4S)framework, the New Zealand Ministry of Education's standard for assessing the safety and privacy of digital tools used in schools. The platform has been designed from the ground up to meet ST4S requirements, and formal accreditation assessment is in progress.

Schools can use this section as evidence of our alignment when completing their own ST4S due diligence. If your school has specific ST4S questions, contact us at pipgorrie@gmail.com.

For ST4S enquiries, contact: pipgorrie@gmail.com

10. Your rights under the Privacy Act 2020

Under the New Zealand Privacy Act 2020, individuals have the right to:

• Request access to personal information we hold about them
• Request correction of inaccurate personal information
• Complain about a breach of the Information Privacy Principles

Requests should be directed to your school’s administrator in the first instance, or directly to our Privacy Officer at pipgorrie@gmail.com.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner (www.privacy.org.nz).

10b. Privacy breach notification

Under sections 113–120 of the Privacy Act 2020, we are required to notify the Office of the Privacy Commissioner, and affected individuals, of any privacy breach that is likely to cause serious harm.

• We maintain an internal Privacy Breach Register for all incidents, including low-severity ones.
• If a notifiable breach is identified, we will report it to the Privacy Commissioner as soon as practicable via www.privacy.org.nz.
• Affected individuals (and/or their school) will be notified as soon as practicable after notifying the Commissioner, with details of what happened and what steps we have taken.
• Schools are encouraged to also maintain their own breach response procedures in line with their obligations as data controllers.

To report a potential breach to us, contact pipgorrie@gmail.com immediately. School administrators can also log incidents directly in Admin → Privacy Breach Register.

11. Cookies and tracking

We use session cookies solely to maintain authenticated login sessions. We do not use advertising cookies, tracking pixels, or any third-party analytics that identify individual users.

12. Changes to this policy

We may update this policy from time to time. Where changes are material, we will notify school administrators by email at least 30 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

13. Contact