Data processing agreement

1. Parties

This agreement is between the school or organisation that holds a Heapso school subscription ("the School") and the operator of Heapso ("Heapso"). It applies to every school subscription and forms part of the School's subscription and the Heapso terms of use. If they conflict, this agreement wins on matters of personal information.

2. Roles

The School controls the personal information processed through its Heapso account ("School Data"). Heapso holds and processes School Data as the School's agent under section 11 of the Privacy Act 2020, only for the purpose of providing the service, and doesn't use or disclose it for its own purposes except as described in this agreement.

3. Categories of information

• Staff account details: name, school email address, role, seat assignment and sign-in records.
• Content created by staff: prompts, plans, worksheets, slides, images, uploaded teaching resources and shared library items.
• If the School connects its student management system: staff names, school email addresses, staff codes and teaching timetables. Student records sent by the system are discarded without being stored.
• Usage data: generation counts, credit use, audit logs of admin actions.

Student information is limited to:

• Student work uploaded for marking. Heapso removes names and identifiers it detects before the work is stored or sent for AI marking, and labels each piece "Student A", "Student B" and so on. Photos are deleted once read, and within a day at most. The work itself is deleted automatically after the period the teacher chooses (1, 7, 14 or 30 days; 14 by default). Grades and feedback stay until the teacher deletes the marking session.
• Live quiz nicknames, answers and scores, entered by students without an account and deleted within 3 hours of the game starting.

The School will instruct staff not to enter information that identifies a student when planning, and to remove names from student work before uploading it where they can. Heapso provides in-product warnings and automatic removal to support this but doesn't guarantee detection.

4. Heapso's obligations

1. Process School Data only on the School's documented instructions, including the settings the School chooses in the admin dashboard.
2. Keep School Data confidential and ensure staff and contractors with access are bound by confidentiality.
3. Apply reasonable security safeguards (IPP 5), including encryption in transit and at rest, access controls that keep each school's and teacher's content separate, and audit logging of admin actions.
4. Not sell School Data, use it for advertising, or use it to train AI models. Heapso uses its AI sub-processors' business services, whose terms say they don't train on that content (see our privacy statement).
5. Help the School respond to access and correction requests (IPPs 6 and 7) within 10 working days of being asked.
6. Keep a record of processing and make information reasonably needed to show compliance available to the School.

5. Location and sub-processors

School Data is stored in Sydney, Australia. The School authorises these sub-processors:

Heapso will give the School at least 30 days' notice of a new sub-processor. The School may object on reasonable privacy grounds and, if the objection can't be resolved, end the subscription with a pro-rata refund. Heapso will impose obligations on each sub-processor that provide comparable safeguards to the Privacy Act (IPP 12) and remains responsible for their performance.

6. Privacy breaches

Heapso will notify the School without undue delay, and in any case within 72 hours, after becoming aware of a privacy breach affecting School Data. The notice will describe what happened, the information involved, likely consequences and steps taken. Heapso will assess whether the breach is notifiable and, where it is, notify the Office of the Privacy Commissioner and affected individuals in coordination with the School.

7. Retention, return and deletion

• From the admin dashboard the School can set a retention period for content in its school space (30 days or longer), export its shared content, member list and admin audit log at any time, delete the content a member created in the school space, and delete the school once its subscription is cancelled.
• Teachers' private drafts aren't visible to the School or included in its export. The export shows how many there are.
• When the subscription ends, School Data stays in place so the School can export it. On the School's request, Heapso will delete School Data within 30 days, with backups rolling off within a further 35 days, unless the law requires us to keep it (for example, billing records).
• On request, Heapso will confirm deletion in writing.

8. Audits and assurance

Heapso will answer reasonable security and privacy questionnaires once a year, or after a breach. Heapso has not had a Safer Technology for Schools (ST4S) assessment.

9. Term and law

This agreement runs for as long as Heapso processes School Data. It is governed by New Zealand law. Clauses 4.2, 6 and 7 survive termination.

Signed copies

This agreement applies without signature. If your school needs a countersigned copy for its records, email privacy@heapso.com.