Learn21 Privacy Policy

Our role

Learn21 provides technology products and services to K-12 schools, districts, educational service agencies, and universities. When Learn21 handles student personal information, it does so solely on behalf of the educational institution that contracts with Learn21, acting as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), 34 CFR § 99.31(a)(1).

The educational institution controls the data. Learn21 processes it under the institution's direction and for no other purpose.

Personal information Learn21 handles

Learn21 collects and maintains student personal information only as necessary to deliver the services its customers have contracted for. Depending on the product and the institution's configuration, this may include student demographic information, course schedules, course history and grades, attendance, and account identifiers.

Learn21 treats indirect identifiers, including email addresses, IP addresses, device information, and other technical data, as personal information when they are linked or reasonably linkable to an individual student.

Learn21 does not collect student personal information for its own purposes, and it does not use that information for any purpose other than providing the contracted services.

Use limits

Learn21 does not collect, maintain, use, or share student personal information beyond that needed for authorized educational or school purposes, or as authorized by the parent or student.

"Educational or school purposes" are services or functions that customarily take place at the direction of the educational institution or agency, or their teacher or employee, for which the institution or agency would otherwise use its own employees, and that aid in the administration or improvement of educational and school activities.

Children's privacy

Some Learn21 services are used by students under the age of thirteen. Where the Children's Online Privacy Protection Act (COPPA) applies, Learn21 relies on the educational institution to provide consent on behalf of parents for the collection of student personal information used exclusively for educational purposes, consistent with FTC guidance. Learn21 does not use information collected from children for advertising, profiling, or any commercial purpose.

Sale of data

Learn21 does not sell student data.

Student profiles

Learn21 does not create or maintain student profiles for non-educational purposes.

Behaviorally targeted advertising

Learn21 does not permit behavioral targeting of advertisements to students. Learn21 does not collect, use, or share student information for any purpose beyond authorized educational or school purposes, or as authorized by the student or parent.

Service providers and third parties

Learn21 shares student personal information with third parties only as necessary to deliver contracted services, and only with providers whose privacy and security practices are consistent with this policy and with Learn21's obligations to the institution.

Learn21 uses the following service providers in the delivery of its hosted products:

Learn21 does not sell, rent, or otherwise disclose student personal information to any party for marketing or advertising purposes. Links to third-party sites are subject to those sites' own privacy practices.

Data location

Student personal information handled by Learn21's hosted products is stored and processed within the United States. Learn21 does not transfer student personal information outside the United States.

Access and correction

Learn21 is committed to data accessibility. Students and parents may review and correct student data either directly through their Learn21 account, where the institution has enabled such access, or by request through their school.

Requests for access, correction, or amendment of education records are governed by FERPA and are directed to and administered by the educational institution.

Data retention and deletion

Learn21 retains student personal information only as long as necessary to deliver contracted services, as directed by the educational institution, or as required by applicable law and records-retention requirements.

Educational institutions may request deletion of their data at any time, and on termination of a contract. On receipt of a deletion request, Learn21 removes the data from production systems.

Learn21 maintains encrypted backup copies for disaster recovery purposes. Backup copies are retained on a defined schedule and expire automatically at the end of that retention period. Data deleted from production systems may remain in encrypted backup copies until those copies expire, after which it is no longer recoverable. Backup copies are not used for any purpose other than restoration of service.

Security

Learn21 maintains a security program designed to protect the security, privacy, confidentiality, and integrity of student personal information against risks such as unauthorized access or use, and unintended or inappropriate disclosure, through administrative, technical, and physical safeguards appropriate to the sensitivity of the information.

Safeguards include encryption of data in transit and at rest, multifactor authentication for administrative access, role-based access controls, centralized log monitoring and intrusion detection, endpoint management and patching, regular vulnerability scanning, and mandatory security and privacy awareness training for all personnel.

Incident notification

In the event of a security incident affecting student personal information, Learn21 will notify the affected educational institution without unreasonable delay and will cooperate with the institution in meeting its notification obligations under applicable federal and state law.

Website analytics and user interaction data

Learn21's public-facing marketing website tracks user interaction data, including pages visited, clicks, session duration, referral sources, and general device and browser information, to understand how visitors use the site and to improve its content and services.

This tracking applies only to the public marketing website. It does not apply to Learn21's products and does not involve student personal information. Visitors are presented with a cookie consent notice on their first visit and may accept or decline analytics tracking at that time.

Learn21's hosted products use session cookies only, for the purpose of maintaining an authenticated session. Learn21's products do not use advertising, tracking, or analytics cookies.

Notice of changes to this policy

Learn21 will provide notice of material changes to this privacy policy. Learn21 will display a prominent statement indicating that changes are in effect, and users will acknowledge the change on their first login following its publication.