School data agreement

Version 2026-10-08 · in effect from 8 October 2026

This agreement applies when a school (or a teacher on a school's behalf) uses Learn It With Me with its students. It sits alongside our terms of use and privacy notice. "We" means Learn It With Me Limited (NZBN 9429054012622); "the school" means the school whose teachers and students use the site.

1. Who is responsible for what

The school is responsible for its students' and staff's personal information, and decides how its classes use the site. We hold and process that information on the school's behalf, to provide the site to it. Under section 11 of the Privacy Act 2020, information we hold only as the school's agent is treated as held by the school. Where the GDPR applies, the school is the controller and we are its processor.

2. The information, and what it's for

We process the information described in our privacy notice: names, email addresses, leaderboard codes, school and class membership, scores, time on resources, progress and grades, sign-in methods and a security log, and, for a subscribing school, its billing details. We use it only to provide the site to the school and its people (accounts, classes, assignments, gradebooks, leaderboards, support and billing) and to keep it secure. We will never:

• sell it, rent it, or give it to anyone for their own use;
• show students adverts, or use their information for marketing or to build profiles of them;
• use it to train artificial intelligence models;
• use it for anything the school hasn't asked for, unless the law requires it.

3. Security

We protect the information with measures that include: HTTPS for every connection, and an encrypted connection to the database; names, email addresses, IP addresses and other identifying details encrypted (AES-256-GCM) before they're stored, with keys kept apart from the database and its backups; passwords stored only as Argon2id hashes; passkey (two-factor) sign-in required for site and school admin powers; a strict Content Security Policy; a security log; limits on repeated sign-in attempts; and access to the information only by our own administrators, only where needed. Our security page has more.

4. Sub-processors and overseas storage

The companies that help us run the site, what they handle and where, are listed in our privacy notice. Our hosting is in the United States. We choose providers that protect information to a standard comparable to New Zealand's, and we'll give schools at least 30 days' notice (by email to their admins) before adding a sub-processor that handles students' information, so a school can raise a concern or stop using the site. A school that needs its information kept in its own country, or on its own servers, can ask about our data residency add-ons.

5. Breaches

If we become aware that a school's information has been accessed, disclosed, changed or lost without authority, we will tell the school's admins without undue delay, and within 72 hours, with what we know, what we're doing about it, and what the school may need to do. We'll work with the school to notify the Office of the Privacy Commissioner and the people affected where the Privacy Act requires it, and keep a record of every breach.

6. Requests from people, and from others

Students and staff can see, download, correct and delete their own information from their account page. If a request comes to the school instead, we'll help it answer, normally within 10 working days. If anyone else (for example, a government agency) asks us for a school's information, we'll refer them to the school and tell it, unless the law stops us.

7. When a school stops using the site

A school can ask, through the support page, for an export of its classes' information (in CSV or JSON), for its students' and staff's accounts to be deleted, or both. We'll do it within 30 days of the school's admins confirming the request. Deleted information leaves our backups within 90 days. Payment records are kept for seven years, as New Zealand tax law requires.

8. The school's part

• Make sure the school may use the site with its students, and that students (and their parents or caregivers where its policies require it) know how it's used, for example by pointing them to the privacy notice.
• Keep its list of teachers and admins up to date, and remove people who leave.
• Tell us promptly about any concern with how information is handled.

9. Checking, changes and the law

We'll answer a school's reasonable questions about how we protect its information, including security and privacy questionnaires such as Safer Technologies 4 Schools (ST4S). If we change this agreement in a way that reduces its protections, we'll email schools' admins at least 30 days before. This agreement is governed by New Zealand law. A school that needs a signed copy, or its own agreement, can ask through the support page.