Is Classroom Hero a controller?
Classroom Hero processes personal information both as a Processor and as a Controller, as defined in the GDPR and/or used under the CCPA or other applicable privacy laws.
When Classroom Hero Acts as a Processor
When the Classroom Hero Services are used in connection with school use, Classroom Hero acts as a Processor (or service provider as defined under CCPA or other applicable privacy laws) and we will process personal information, including Student Data, only at the direction and control of the school. Additionally, Classroom Hero will only delete personal information and Student Data or education records per the school's specific instructions.
School-Directed Processing
For Student Data and Educational Activities:
- Student account creation and management through teacher-provided classroom codes
- Points awarded through teacher-defined Actions and classroom activities
- Virtual marketplace transactions and gamification features
- Avatar customizations and Mysteria game progress
- AI-generated quiz completions and educational content interactions
- Class Goals progress and collaborative classroom achievements
Teacher and School Control:
- Teachers act as agents of the school and have complete control over student data
- Schools direct how long student information is retained
- Schools determine what student data should be deleted and when
- All student data processing follows school policies and educational compliance requirements
Making Requests as a Processor
As a student, teacher, or parent making a request about a student's personal information, you should direct any requests for access, correction or deletion of personal information through the school as further detailed in our "Parental Choices" section. If we receive a request relating to personal data that we hold on behalf of a school acting as the data Controller, we will either refer you to the school or handle the request directly if authorized by the school.
Process for Data Requests:
- Student Data Requests: Contact the student's teacher or school administration first
- School Authorization: Schools determine whether requests should be implemented
- Teacher Action: Teachers can immediately delete or modify student data through their dashboard
- Direct School Request: Schools can contact us directly for data management assistance
When Classroom Hero Acts as a Controller
Classroom Hero will generally be the Controller when:
Account Registration and Management
Teachers, School Leaders, and Parents enter personal information directly into our Service when registering for an account, including:
- Name, email address, and password for account creation
- School affiliation information for verification purposes
- Profile photos and account preferences
- Subscription and billing information for teachers and School Leaders
Important Note: This does not include personal information provided by teachers, School Leaders, and parents through their school-related use of the Classroom Hero Services (e.g., classroom setup, student management, educational activities).
Limited Parent Account Features
Parent Account Linking: When parents create accounts to view their child's basic progress information, we act as a Controller for:
- Parent account registration information
- Basic profile data for account linking purposes
- Parent preferences for viewing their child's educational progress
Important Limitation: Unlike comprehensive educational platforms, Classroom Hero does not currently offer extensive parent features outside of school use. Our parent functionality is limited to basic account linking and progress viewing, which reduces the scope of Controller responsibilities.
Simplified Data Processing Model
Streamlined Approach
Classroom Hero's simplified platform design results in clearer Controller/Processor distinctions:
Primarily Processor Role:
- Most platform activity involves processing Student Data under school direction
- Teachers control all student interactions and data management
- Educational activities are directed by schools and teachers
- Gamification features operate under educational supervision
Limited Controller Role:
- Adult user account registration and management
- Subscription processing for teachers and School Leaders
- Basic parent account linking (when implemented)
Educational Compliance Benefits
This clear separation provides several advantages:
- Simplified FERPA Compliance: Clear school control over education records
- COPPA Protection: School consent model with teacher oversight
- Reduced Liability: Limited Controller responsibilities
- Clear Data Governance: Unambiguous roles and responsibilities
Technical and Legal Framework
Data Processing Agreements
Student Data Privacy Addendums: We enter into agreements with schools and districts that clearly define:
- Our role as Processor for Student Data
- School responsibilities as Controller for educational information
- Data retention and deletion procedures
- Security and privacy obligations
Regional Compliance
International Considerations:
- GDPR compliance for European users with clear Controller/Processor roles
- CCPA compliance for California residents with appropriate service provider designations
- Other regional privacy law compliance with consistent data processing roles
Service Provider Relationships
When acting as a Processor, our relationships with third-party service providers are structured to maintain the school's Controller status:
- DigitalOcean hosts data under our direction as Processor
- Analytics providers receive only anonymized data
- AI service providers operate under zero data retention contracts
Practical Implications
For Schools and Teachers
As Controller (School) to Processor (Classroom Hero):
- Schools maintain ultimate authority over Student Data
- Teachers act as agents of schools with immediate platform control
- Data Processing Addendums define the relationship clearly
- Schools can direct data deletion or retention as needed
For Parents
Simplified Request Process:
- Most requests should go through schools first
- Teachers can immediately address most data management needs
- Limited direct Controller relationship reduces complexity
- Clear educational context for all data processing
For Students
Protected Status:
- Student data is always processed under school direction
- Teachers maintain immediate control over student information
- Educational purpose drives all data processing decisions
- Strong privacy protections through Processor model
Basically,
Classroom Hero acts as a Processor when handling Student Data and educational activities under school direction, and as a Controller primarily for teacher, School Leader, and parent account registration. This simplified model means schools maintain control over Student Data while we handle the technical platform operations. Most data requests should go through schools first, since teachers have immediate control over student information and can delete or modify it instantly through their dashboard.