Privacy Policy
Version 2026-10-21 · Effective October 21, 2026
Please review the complete document. Section links below help you navigate; they do not replace the provisions themselves.
Service provider / trading name: edvance
Legal contact: support@edvance.space · Privacy contact: privacy@edvance.space
1. Scope, identity, and relationship to your agreement
This Privacy Policy explains how the operator of the Service under the trading name edvance, referred to as we, us, or our, handles Personal Data in connection with its websites, applications, tenant workspaces, administrative panels, support channels, and related services. Personal Data means information relating to an identified or identifiable individual and includes equivalent categories under applicable privacy law. This Policy should be read with the Terms of Service and any applicable institutional notice, Order, or Data Processing Agreement.
This Policy describes different activities and roles; it does not mean that every listed category is collected in every deployment or that an optional or future feature is already available. We collect and process information relevant to the services and interactions actually used. A school may configure a narrower scope or agree additional restrictions. Where we act as processor, the school's lawful instructions and controlling DPA govern that processing.
This Policy is a transparency notice, not a blanket request to consent to all processing. Accepting an account agreement or acknowledging this Policy does not waive privacy rights or supply consent where a separate, specific choice is required. Mandatory laws and binding negotiated protections control over any inconsistent general statement. Questions and privacy requests may be sent to privacy@edvance.space; service and institutional contract questions may be sent to support@edvance.space.
2. Who determines processing purposes
For school-managed student, guardian, staff, and academic records, the school or subscribing institution ordinarily determines why records are processed and who may access them. In that context, edvance ordinarily provides processing services on the institution's behalf. The institution is generally the first contact for educational record access, corrections, retention decisions, and permissions within its tenant.
For our own website inquiries, business account administration, billing contacts, contractual evidence, service security, fraud prevention, and legal compliance, we may determine purposes independently and act as controller. A single interaction may involve both roles, but we do not treat processor-held education records as freely available for independent commercial purposes. The actual legal role depends on the facts and applicable law.
A school group, reseller, integration provider, payment provider, or external website may have its own role and privacy notice. We will not claim to control an independent provider's practices. Where parties jointly determine a processing activity, any legally required allocation of responsibilities must be established for that activity rather than assumed from this Policy.
3. People and services covered
This Policy may apply to school owners, administrators, teachers, non-teaching staff, students, parents, guardians, prospective customers, website visitors, support requesters, and other authorized contacts. The fields and processing relevant to a person depend on the role, institution, jurisdiction, feature, and applicable contract. Not every user is a direct subscriber or a person who can authorize institutional processing.
The Service is intended for authorized educational and administrative use. Children may use an age-appropriate institutional service only under the required school or parental arrangements. A student or guardian account does not grant permission to inspect every record held about another person, and a school cannot use a generic acceptance checkbox to override an applicable child privacy requirement.
This Policy does not cover employment applicants or employees in their employment relationship unless expressly stated in a relevant workforce notice. It does not govern third-party sites merely linked from the Service. An external integration selected by an institution may require its own assessment and notice before personal information is transferred.
4. Information supplied by customers and users
Depending on the selected Service, an institution or user may provide names, email addresses, telephone numbers, school and class affiliations, account roles, identifiers, dates of birth where needed, contact addresses, and profile details. Guardian information may include the relationship to a student and the permissions associated with that relationship. We do not need every possible identifier for every activity and ask institutions to avoid unnecessary fields and attachments.
Educational and administrative records may include enrollment, attendance, classes, subjects, timetables, coursework, assessment materials, grades, reports, academic history, and institution-configured notes. Staff records may include role, qualifications, teaching assignments, and work contact details where the institution uses those features. Information concerning disability, health, safeguarding, or other sensitive matters must be limited to an expressly supported, authorized purpose with appropriate additional safeguards.
Messages, uploaded documents, support correspondence, feedback, and import files may contain information the sender includes. Users must not send passwords, full payment credentials, excessive identity documents, or unrelated sensitive records through ordinary feedback or support channels. We may request a safer channel, redact unnecessary information, or restrict an upload that exceeds the authorized scope.
5. Account, invitation, and consent information
Account administration may involve usernames, role assignments, tenant identifiers, password verification data, recovery and verification status, session information, and account lifecycle events. We use this information to create and protect accounts, verify appropriate access, and administer institution-specific permissions. Passwords must be handled through the designated credential flows; support staff should never need a user's plaintext password.
Invitation records may include the inviting administrator, intended recipient, role, tenant, delivery status, expiry, and acceptance event. These records support authorized onboarding and investigation of misuse. An invitation is not an authorization to process unrelated information about the recipient, and a forwarded link does not establish institutional or parental authority.
Where applicable, acceptance evidence may include document version, account or operator identifier, timestamp, acceptance method, and proportionate network or device information. Assisted onboarding records may identify the operator's attestation that the owner actually accepted the documents. We retain evidence needed to demonstrate the agreement or consent event without treating it as permission for unrelated processing or an unlimited retention license.
6. Technical and usage information
When a person visits or uses the Service, systems may process IP address, approximate region inferred from network information, browser and device characteristics, request time, session identifiers, pages or functions used, errors, and diagnostic events. The precise collection depends on the deployment and enabled tools. We use necessary technical information to serve requests, maintain sessions, diagnose faults, secure access, and operate the selected functions.
Operational logs may record actions such as login, account changes, record access or modification, import, export, and administrator activity where the feature provides those logs. Such records can themselves be Personal Data and must have a defined purpose, access restriction, and retention justification. A security log is not automatically exempt from privacy obligations.
We do not infer that a device belongs exclusively to one person, and approximate location is not the same as verified residence. We do not collect precise device geolocation merely because a school has an address. If a feature requires additional device permissions or a materially different type of monitoring, the relevant notice and lawful permission must precede that collection.
7. Payments, orders, and commercial records
For subscriptions and purchases, we may process purchaser and billing contact details, organization name, plan, transaction identifier, payment status, currency, amounts, tax information, invoices, refunds, and subscription events. Payment collection may be handled by a payment provider or merchant of record identified at checkout. Its independent processing is governed by its own notice and legal obligations.
We do not ask users to place complete card numbers, security codes, online banking credentials, or payment authentication secrets in school records or support messages. Payment account information returned to us depends on the selected provider and integration. A transaction reference or limited payment method description may be needed to reconcile a purchase without requiring full credentials.
Commercial records may be retained for accounting, tax, anti-fraud, dispute, and legal purposes for periods justified by the applicable obligations. That does not authorize retaining all associated educational content for the same period. School record processing and payment record processing have distinct purposes and access needs.
8. Information from institutions and other sources
We may receive information from an institution's administrators, authorized users, approved imports, guardians, and integrations the institution chooses. We may also receive business contact details from a person who requests a demonstration, refers a colleague, attends an authorized event, or communicates with our team. We will not assume that a third-party referral authorizes unrestricted marketing or disclosure of student data.
Integration data must be relevant to the feature and transferred under appropriate authority. Where an external identity provider authenticates a user, it may supply a limited identity assertion and approved profile attributes. Its authentication confirmation does not decide every tenant permission or prove a guardian relationship on its own.
If we obtain Personal Data indirectly and applicable law requires an individual notice, we will provide it or support the responsible institution in doing so, subject to lawful exceptions. Individuals may ask about the source and relevant categories using the rights process below. We may limit disclosures that would expose another person's protected information or security details.
9. Purposes for delivering the service
We process authorized information to establish tenants and accounts, assign and verify roles, support invitations, display and organize institutional records, operate academic and administrative workflows, produce requested reports, and deliver authorized communications. The relevant purpose is the function the institution or individual lawfully requests, together with processing reasonably necessary to provide it.
We may transform, index, format, cache, replicate, and back up information to make the selected functions work reliably. These operational activities do not change ownership or permit unrelated exploitation. A copy needed for recovery remains subject to confidentiality, access, retention, and deletion requirements.
We may provide support by reviewing the minimum information needed to understand and resolve an issue, under appropriate authorization. Customer support access is not permission to browse educational records without a legitimate need. Where practicable, we will use technical observations, redacted examples, or metadata before requesting additional sensitive content.
10. Security, integrity, and abuse prevention
We process relevant account, session, network, and audit information to detect unauthorized access, investigate suspicious activity, prevent fraud, protect tenant boundaries, recover compromised accounts, and enforce legitimate use restrictions. These purposes help protect users and Customer records and may continue for a limited justified period after an account closes.
Security processing should be proportionate to the risk and should not become general behavioral surveillance. Access to investigative records must be limited to personnel or providers who need it. We may preserve evidence of a genuine threat or dispute where lawful and necessary, with restricted use and review of the continuing need.
We may share relevant information with an affected institution, a security provider, a professional adviser, or a lawful authority when justified under the disclosure rules below. We will not disclose passwords or unrelated student records merely to help a requester prove an allegation. A security report may require identity and authority verification before detailed information can be released.
11. Administration, improvement, and business communications
We may use business and operational information to administer contracts, reconcile subscriptions, respond to inquiries, communicate service changes, evaluate performance, allocate resources, and improve reliability and usability. Where Personal Data is involved, we apply an appropriate legal basis and respect the restrictions attached to our role and the original collection purpose.
Deidentified or aggregated measurements may help us understand broad usage patterns, evaluate features, plan capacity, and publish nonidentifying trends. We must assess whether a statistic can reveal a person or a small class through combination or context. Data is not anonymous simply because a name is removed. We will not intentionally reidentify data represented as deidentified or permit a provider to do so contrary to its obligations.
Marketing communications are directed to appropriate adult business contacts where legally permitted and are subject to required consent and opt-out rules. School-authorized student information is not a marketing audience. A user's decision to decline optional marketing does not authorize us to withhold essential service notices or deny a mandatory privacy right.
12. Legal bases for processing
Where law requires a legal basis, we assess the relevant processing activity separately. Bases may include performing a contract with an individual, complying with a legal obligation, pursuing legitimate interests subject to the applicable balancing test, obtaining valid consent, or another basis available under local law. An institution's contract is not automatically a contract with every student whose records it holds.
For processing on an institution's behalf, the institution must establish the appropriate basis, and we process under lawful instructions and the DPA. Education privacy laws may impose additional use and disclosure conditions rather than supply a general legal basis. We do not represent that a single regulatory label, such as FERPA, independently authorizes every activity.
Where consent is required, it must be specific, informed, freely given where applicable, and capable of withdrawal. Withdrawal affects future consent-based processing and does not retrospectively invalidate lawful prior processing. A different lawful retention duty may still apply to a limited record. We will not switch legal bases merely to defeat a valid withdrawal or objection.
13. Sensitive information and minimization
Some educational records may reveal health, disability, religion, safeguarding circumstances, or other information receiving enhanced legal protection. Customer must determine whether a feature is appropriate and supported before submitting such data. A general-purpose notes field does not establish an appropriate basis for collecting every sensitive fact about a child or family.
Where such processing is expressly supported, the parties must identify the additional legal condition, limit collection and access, and apply safeguards appropriate to the sensitivity. We may refuse or restrict information outside the agreed scope. We do not require biometric templates, genetic data, or detailed clinical histories as a condition of ordinary access to the Service.
Individuals and institutions should avoid excessive free-text detail, unnecessary identity documents, and duplicate uploads. We may help with correction, redaction, or deletion through authorized channels, subject to relevant recordkeeping duties. Minimization applies to support records, exports, logs, and backup policies as well as visible profile fields.
14. Children and school-authorized use
We recognize that children's information requires particular care. Where applicable law requires verifiable parental consent or permits a school to authorize limited educational processing, the responsible authorization must be obtained before the relevant collection. A child's checkbox or a teacher's unverified personal account is not a substitute for the required authority.
When an institution authorizes processing for its educational service, we limit that information to the requested educational purpose and legally permitted supporting operations. We do not use school-authorized children's Personal Data for unrelated behavioral advertising, sale of student profiles, or unrelated commercial model training. Additional commercial purposes cannot be introduced through a broad statement that use of the Service implies consent.
We will not retain children's Personal Data longer than reasonably necessary for the specified purpose and applicable legal duties. Where valid authorization is absent or collection was improper, we will work through appropriate verification and protective measures to stop the affected processing and address deletion as required. A parent or guardian who believes a child has provided information improperly may contact privacy@edvance.space without sending the child's full record in the initial message.
15. Education records and institutional control
Where FERPA or an equivalent educational records regime applies, the institution must establish the relevant disclosure conditions and maintain required control over use and maintenance of protected records. If relying on the school official exception, the parties must satisfy its substantive requirements, including institutional purpose, legitimate educational interest, and applicable redisclosure limits.
We do not claim ownership of Education Records or acquire permission to disclose them publicly. Institutional permissions should reflect the user's role and, for guardians, the authorized relationship to the relevant student. A shared surname, an email address, or knowledge of a student's details does not independently establish a right to receive records.
Requests for inspection, correction, or educational record amendment are generally handled by the institution under its applicable process, with our assistance for processor-held records. We may be unable to change an official academic decision directly. That limitation does not remove an individual's right to complain about our independent processing or require us to ignore an obvious unauthorized disclosure.
16. Artificial intelligence and automated features
Some available or future features may use automated analysis or AI to support requested educational or administrative tasks. Before personal information is used in a new feature, the parties must assess the purpose, data categories, provider access, required notices, legal basis, and any additional contractual restrictions. This Policy does not mean that all described AI capabilities are currently deployed.
Where AI processes Customer Data, it must remain within authorized instructions and applicable provider restrictions. We do not use identifiable school records to train a generally available model without a separate lawful arrangement expressly permitting that processing. We do not treat an ordinary subscription purchase as permission to disclose unrestricted records to any AI provider we later select.
Outputs may be inaccurate, incomplete, or biased and require appropriate human review. We do not authorize solely automated decisions with legal or similarly significant effects where law requires additional safeguards. Where a relevant automated decision process is actually introduced, affected persons must receive the legally required information and routes to challenge, obtain human intervention, or exercise other applicable rights.
17. Cookies, local storage, and similar technologies
The Service may use cookies, session storage, local storage, and similar technologies to maintain authentication, support requested functions, remember permitted preferences, and protect security. The technologies present depend on the site and deployment. A necessary session mechanism has a different purpose from an optional advertising tracker and must not be described as interchangeable.
Nonessential analytics, advertising, or personalization technologies must be subject to the notices and choices required by applicable law before they are used. This Policy does not assert that a universal consent manager or every browser preference signal is already supported. Where a legally applicable opt-out preference signal must be honored, we will handle it as required for the relevant processing.
Users can manage many browser storage settings, but disabling necessary storage may prevent sign-in or requested functionality. Clearing local storage does not necessarily cancel a subscription, delete server-held records, or withdraw an institution's lawful processing instructions. Requests concerning server-held data should follow the rights procedure below.
18. Service providers and subprocessors
We may engage providers for hosting, storage, communications, support, security, operational monitoring, and other functions required to deliver the Service. Where a provider processes Personal Data for us, access must be limited to its legitimate task and subject to appropriate contractual confidentiality, security, use, retention, and deletion obligations.
We do not give a provider unrestricted rights to exploit school records for its own advertising or unrelated commercial purposes. Providers may be located in different countries depending on the deployment and any agreed restrictions. Information about relevant subprocessors, locations, and material changes can be requested through support@edvance.space and is governed by any applicable DPA notice procedure.
Independent providers selected by an institution, such as an external communication or identity service, may process information under their own agreement with that institution. We will distinguish that relationship from our own subprocessors where relevant. Customer should review the provider and scope before enabling an integration that shares personal information.
19. Sharing within institutions and authorized relationships
We disclose information through tenant permissions and workflows to authorized institutional administrators and users for the functions they are permitted to perform. Teachers, staff, students, and guardians may receive different views. Access should be limited to the relevant tenant, role, student relationship, and account status; authorization is not determined solely by possession of a URL.
An institution may instruct us to export records, deliver a message, or make information available to an approved integration. It must have authority for that instruction and provide necessary notices. We may seek verification or decline a request that appears unlawful, exceeds the requester's role, or would expose another person's protected records.
When a user changes institution or role, prior information is not automatically transferred to the new institution. Transfers must follow a lawful instruction and applicable educational record rules. Data visible to a guardian may change when the student reaches an age or status at which law assigns rights differently, or when the institution verifies a change in authority.
20. Legal disclosures and protection of rights
We may disclose information when reasonably necessary to comply with a binding legal obligation, court order, or valid legal process; establish or defend legal claims; investigate serious misuse; or protect persons against a credible threat, in each case subject to applicable law and role-specific restrictions. A broad request from an official or third party does not automatically justify disclosure of all records.
Where lawful and reasonably practicable, we will notify the responsible Customer of a legally compelled disclosure affecting processor-held records, assess the request's scope, and limit information to what is required. We may be prohibited from notifying a person, or notice may create a serious risk to an investigation or individual. We will not promise notice in circumstances where law forbids it.
Professional advisers, insurers, auditors, and legal representatives may receive information necessary for legitimate advice or compliance under appropriate confidentiality duties. We will seek to use redacted or minimized information where possible. A legal defense purpose does not justify retaining every tenant's full educational history indefinitely.
21. Corporate transactions and organizational changes
Personal Data may be reviewed or transferred in connection with a genuine financing, merger, acquisition, restructuring, insolvency process, or transfer of the relevant business. Due diligence access must be proportionate and protected through confidentiality and appropriate access controls, with minimized or deidentified information where feasible.
A successor must respect the applicable privacy restrictions and contractual obligations for transferred information. A corporate transaction does not transform school-authorized data into a general advertising asset or remove an individual's statutory rights. Where law requires notice, consent, or another safeguard for a materially different purpose or transfer, that requirement must be satisfied.
We may share appropriate administrative information within an affiliated group to support the Service, subject to lawful purpose, contractual protections, and any location restrictions. Affiliation alone does not authorize access to student records. The responsible contracting entity and processor relationships should be identified in the applicable enterprise documentation.
22. No sale of school records and limits on secondary use
We do not sell identifiable school records or school-authorized children's Personal Data, rent student contact lists, or use those records for unrelated cross-context behavioral advertising. We do not treat a processing license as a transfer of title to Personal Data. Definitions of sale, sharing, and targeted advertising vary by jurisdiction, and we will assess the applicable statutory meaning for the processing actually performed.
For business contact or website processing, any activity subject to an applicable sale, sharing, or targeted advertising opt-out right must be disclosed and subject to the required mechanism before that activity occurs. This Policy does not preauthorize a future advertising business model or claim that every external website uses no trackers. A materially new purpose requires a fresh legal assessment and appropriate notice or choice.
Deidentified or aggregated information may be used for legitimate analysis and commercial planning only where it satisfies the relevant standard and contractual restrictions. We will not attempt to circumvent a restriction by applying an identifier that still permits reasonably likely reidentification. Small cohorts, rare characteristics, and linked datasets require particular care.
23. Hosting locations and international transfers
Personal Data may be processed where our authorized personnel and providers operate, subject to the deployment and any written location commitments. A user's country, a local sales presence, or the currency used to pay does not by itself establish local storage or exclusive processing within that country. Customers with residency requirements should obtain written deployment particulars before submitting records.
Where data crosses a border and applicable law requires safeguards, we will use the relevant lawful mechanism, such as a recognized adequacy basis, approved contractual safeguards, or another available legal route, with additional measures where required. We will not rely solely on acceptance of these Terms to replace a mandatory transfer assessment or contractual instrument.
Individuals or institutions may request information about applicable safeguards through privacy@edvance.space, subject to proportionate redaction of protected commercial and security details. A controlling DPA or mandatory transfer instrument may give additional rights, notice requirements, or remedies. We do not represent that every deployment has an identical subprocessor list or transfer destination.
24. Security commitments and practical limits
We will maintain measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration, and disclosure, appropriate to the nature and risk of processing. The program should address access management, personnel confidentiality, secure communications, protection of stored information, change and vulnerability management, recovery, and incident handling. Specific purchased controls must be documented in the applicable security schedule.
This Policy does not claim a particular certification, audit report, encryption algorithm, dedicated environment, backup interval, or recovery target that has not been expressly confirmed for the deployment. We will not describe an aspirational feature as an implemented safeguard. Reasonable security requires ongoing maintenance and cannot guarantee that every attack or failure will be prevented.
Institutions and users also influence security through passwords, devices, role assignments, email accounts, integrations, and exported files. They should report suspected exposure promptly through support@edvance.space and avoid sending sensitive records over an unsuitable channel. Shared responsibility does not excuse us from the safeguards for systems and processing we control.
25. Security incident response
If we become aware of a confirmed Security Incident affecting Personal Data under our control, we will investigate, contain and remediate as appropriate, and notify the responsible parties within the time required by law or the DPA. Where we act as processor, notice will be directed to the institution without undue delay; where we have an independent duty to notify an individual or regulator, we will fulfill that duty.
An initial notice may contain preliminary information and be supplemented as facts become available. We will provide relevant information we can lawfully share concerning the nature of the incident, affected categories, likely consequences, and mitigation. We may protect another Customer's information, security-sensitive details, and legal privilege while still supporting the recipient's legal obligations.
Not every failed login, blocked attack, service interruption, or unverified allegation is a reportable personal data breach. We will assess the facts under the applicable standard. This distinction does not permit ignoring credible reports or delaying a legally required notification while awaiting full certainty or commercial approval.
26. Retention principles and decision criteria
We retain Personal Data for the period reasonably necessary for the specific purpose for which it was collected, the applicable contractual instructions, and legal obligations. Relevant criteria include whether an account is active, whether the record is needed for the requested educational function, mandatory recordkeeping periods, limitation periods, unresolved complaints, security investigations, and a narrowly scoped legal hold.
For processor-held school records, retention is governed by lawful institutional instructions, the DPA, and applicable education and privacy law. For our independent accounting, security, and contractual records, we apply the relevant purpose and legal requirements. A single account closure date need not apply identically to an invoice, a student report, a support attachment, and a consent record.
We do not retain children's information indefinitely because it might be useful someday. We will restrict access to retained records, review continuing necessity, and delete or deidentify information when no justified purpose remains. If a Customer needs fixed retention or deletion deadlines, they should be specified in the DPA or an agreed retention schedule rather than inferred from this general Policy.
27. Record category retention schedule
Active institutional records are held while needed for the authorized educational service and the institution's lawful retention instructions. Archived educational records require an identified institutional purpose, appropriate access restrictions, and an agreed retention basis. Account and role records are held while needed to administer access, with limited residual evidence where justified for security, dispute handling, or legal obligations.
Billing and tax records are held for the period required by the relevant accounting, tax, and legal duties. Security and diagnostic records are held for a risk-based period necessary for investigation and protection, extended only for a documented issue or legal requirement. Support correspondence is held for resolution, follow-up, and justified service or dispute needs, with unnecessary sensitive attachments removed or minimized where appropriate.
Consent and contract evidence may be held as needed to demonstrate the applicable acceptance and handle a relevant claim or regulatory inquiry. Optional marketing contact data is held until withdrawal or until it is no longer relevant under the applicable retention practice, with a minimal suppression record where necessary to respect the opt-out. Backups expire through protected rotation cycles under the deployment's recovery and deletion arrangements. These are purpose-based rules; no undocumented universal numerical period is represented as an implemented system guarantee.
28. Deletion, backups, and legal holds
Valid deletion instructions will be handled in accordance with our role, applicable law, the DPA, and necessary verification. Deletion from live systems may occur before expiry from protected backups. Backup copies must remain restricted from ordinary use and expire through the applicable rotation; if restored for recovery, relevant deletion and access restrictions must be reapplied.
A legal hold may preserve relevant information while a genuine proceeding, investigation, or statutory duty requires it. We will limit the scope, restrict processing to the justified purpose, and review release when the obligation ends. A general possibility of a future dispute is not a justification to retain all school data forever.
We may retain a minimal record necessary to demonstrate a deletion request, prevent repeated prohibited contact, comply with a legal obligation, or establish a specific legal claim. Where a request cannot be fully granted, we will explain the applicable reason to the extent law permits. Deletion may be irreversible, and we cannot promise recovery of records that have legitimately expired.
29. Your rights and available requests
Depending on applicable law and our role, you may have rights to know whether Personal Data is processed, access a copy, understand relevant categories and purposes, correct inaccurate information, request deletion, restrict processing, object, withdraw consent, receive eligible data in a portable format, or challenge certain automated decisions. These rights may have conditions, exceptions, and different procedures for educational records.
You may contact privacy@edvance.space with a clear description of your request and the institution or account involved. Do not include passwords or a full student record in the first message. We will use proportionate verification and may request clarification to identify the correct records, protect other individuals, and avoid disclosing information to an unauthorized person.
We will respond within the period required by applicable law and explain any lawful extension or refusal. Requests are generally free unless law permits a reasonable fee or refusal for a manifestly unfounded, excessive, or repetitive request. We will not discriminate against an individual for exercising a protected right, and a contractual acceptance cannot require surrender of a nonwaivable right.
30. School records, guardians, and authorized agents
If your information is controlled by a school, contact that institution's administrator or privacy contact for record access, correction, or deletion instructions. We will reasonably assist the institution with processor-held data and may forward your request to it after appropriate handling. We will address any separate request concerning our own controller processing directly.
A parent, guardian, representative, or authorized agent may need to establish authority proportionate to the sensitivity of the request. We will not release a child's records solely because the requester knows the child's name or attends the same school. Where a law gives rights directly to a student or restricts parental access, the institution and we must respect that allocation.
Some corrections affect official academic decisions rather than a simple factual field. The institution's lawful amendment or appeal process may apply. We can assist with technical correction under valid instructions but cannot independently adjudicate an examination result, custody dispute, or disciplinary determination. These limits do not restrict complaints about our own security or processing conduct.
31. Objections, preferences, and withdrawal
Where processing relies on legitimate interests, you may object on grounds relating to your situation, and we will apply the relevant legal test. You may object to direct marketing where law provides that right and use the unsubscribe mechanism in applicable messages. Essential security, billing, contractual, and requested service notices may still be sent when justified independently of marketing consent.
Where processing relies on consent, you may withdraw it through the mechanism provided or by contacting privacy@edvance.space. We will explain material consequences for an optional feature where appropriate. Withdrawal does not authorize deletion of a record that must be retained by law, nor does it permit continuing the same consent-dependent purpose under a pretextual replacement basis.
Browser settings may control some local preferences, but they do not necessarily communicate every server-side rights request. Where applicable law requires recognition of a valid universal opt-out signal, we will apply it to the relevant activity. A school administrator may manage tenant settings, but cannot waive another person's nonwaivable privacy rights.
32. Regional rights and regulatory complaints
Where European Economic Area or United Kingdom law applies, relevant rights may include access, rectification, erasure, restriction, portability, objection, consent withdrawal, and safeguards concerning qualifying automated decisions, subject to the applicable conditions. You may complain to a competent supervisory authority, including one in your habitual residence, workplace, or the place of an alleged infringement where the law permits.
Where the Nigeria Data Protection Act applies, individuals may exercise the rights provided by that law and raise concerns with the Nigeria Data Protection Commission. We will assess lawful bases, transparency, security, retention, children's data, and international transfers under the requirements applicable to the processing rather than treating a foreign contract clause as an exemption.
Where United States state privacy or student privacy laws apply, additional access, correction, deletion, portability, opt-out, appeal, or authorized agent rights may exist, subject to statutory scope and exemptions. Where a denial is appealable, contact privacy@edvance.space with the original request reference and the word Appeal. This Policy does not assert that every statute applies to every deployment or limit a statutory right to contact an authority directly.
33. Changes, versions, and prior information
We may update this Policy to reflect changes in actual processing, law, providers, or services. The document version and effective date identify the published text. For material changes, we will provide the notice required by law or contract and, where necessary, obtain a new consent, revised instruction, or contractual amendment before introducing the affected processing.
A revised notice does not automatically authorize a materially incompatible use of previously collected school records. We must assess the original purpose, applicable restrictions, legal basis, and necessary choices. We will not rely on a statement that continued use alone means agreement to every future privacy change where affirmative permission is legally required.
Institutions should maintain contact details for notices and review material changes affecting their deployment. We will preserve relevant version and acceptance evidence where necessary. A request for an earlier version may be made through privacy@edvance.space, subject to the records available and applicable obligations.
34. Contact, verification, and safe communications
For privacy questions, rights requests, child privacy concerns, or information about our controller processing, contact privacy@edvance.space. For institutional contracts, DPAs, subprocessors, deployment details, or support, contact support@edvance.space. Include the relevant organization and a safe reply address, and avoid attaching passwords, payment credentials, complete identity documents, or unnecessary student records.
The contracting entity and any required postal notice, representative, or data protection contact particulars must be provided in the applicable institutional documentation or through the contact route where legally required. This Policy does not appoint a statutory data protection officer or foreign representative by implication. We will provide the appropriate contact when a legal appointment requirement applies.
The current Policy is available at https://edvance.space/privacy-policy and the Terms at https://edvance.space/terms-of-service. If you cannot access a document or need an accessible copy, contact support. You may raise concerns with a competent regulator without first completing a commercial dispute process or surrendering an applicable statutory remedy.