Privacy and Compliance Regulations

Data Separation

Paxaver separates personal data by country. Where a province or state law requires it, Paxaver separates data by province or state as well. This means that data collected from a Canadian school stays in the Canadian region, and data collected from a United States school stays in the United States region.

Within Canada, data for schools in British Columbia, Alberta, and Quebec is separated to meet the requirements of PIPA and Quebec Law 25. Within the United States, data for schools in California, Colorado, Virginia, and Maryland is separated to meet the requirements of CCPA/CPRA, CPA, VCDPA, and MODPA.

Data Migration

If you move from one country to another, or in some cases from one province or state to another, you do not need to create a new user account. Contact Paxaver support and we will migrate your data to the correct region.

To request a data migration, send an email to feedback@paxaver.com with the subject "Data Migration". Include your current region, your new region, and the email address on your account. Paxaver will confirm your identity before the migration starts.

Canada

Paxaver complies with federal Canadian privacy law and with the provincial privacy laws that apply in each province and territory.

PIPEDA — Personal Information Protection and Electronic Documents Act

PIPEDA is the federal Canadian privacy law. It sets the rules for how private organizations collect, use, and disclose personal information. Paxaver complies with PIPEDA by obtaining consent before collection, limiting collection to what is necessary, protecting personal information with security controls, and giving individuals the right to access and correct their data.

FIPPA — Freedom of Information and Protection of Privacy Act

FIPPA applies to public bodies in British Columbia, Ontario, and Manitoba. Where a school is a public body subject to FIPPA, Paxaver supports the school's obligations by limiting data access to authorized staff, keeping access logs, and providing tools to respond to access requests.

PIPA — Personal Information Protection Act (British Columbia and Alberta)

British Columbia and Alberta have their own personal information protection acts, also named PIPA. These laws are substantially similar to PIPEDA. Paxaver separates data for schools in British Columbia and Alberta to meet the provincial requirements, and applies the same consent, security, and access standards as under PIPEDA.

FOIP — Freedom of Information and Protection of Privacy Act (Saskatchewan)

FOIP applies to public bodies in Saskatchewan. Where a Saskatchewan school is a public body subject to FOIP, Paxaver supports the school by limiting collection to authorized purposes, securing personal information, and providing access and correction tools.

Quebec Law 25

Quebec Law 25 modernizes the Quebec privacy framework. It requires a privacy impact assessment for projects that involve personal information, a person in charge of personal information, and consent that is specific, free, and informed. Paxaver separates data for schools in Quebec, designates a person in charge of personal information within Smartoire, and conducts privacy impact assessments for new features that process student data.

CASL — Canada Anti-Spam Legislation

CASL sets the rules for commercial electronic messages in Canada. Paxaver obtains express or implied consent before sending commercial electronic messages, includes a clear identification of the sender, and provides a working unsubscribe mechanism in every commercial message.

Europe

GDPR — General Data Protection Regulation

GDPR is the European privacy law. It applies to the processing of personal data of individuals in the European Union and the European Economic Area. Paxaver complies with GDPR by relying on a lawful basis for each processing activity, providing transparent privacy notices, honoring the rights of access, rectification, erasure, restriction, portability, and objection, and using standard contractual clauses for any data transfer outside the European Union.

For students in Europe, Paxaver processes student data only at the direction of and with the authorization of the school or parent, and supports the school in meeting its obligations as a data controller.

United States — Federal

FERPA — Family Educational Rights and Privacy Act

FERPA protects the privacy of student education records. Paxaver processes student data at the direction of the school, which is the FERPA school official. Paxaver uses student data only to provide the service that the school authorized, limits access to authorized school staff, and does not disclose education records to third parties without school authorization.

COPPA — Children's Online Privacy Protection Act

COPPA protects the privacy of children under 13. Paxaver is not directed at children under 13, and children do not create accounts or interact with the service directly. Student information is provided by parents, guardians, or school staff. Paxaver processes student data only at the direction of and with the authorization of the school or parent, and schools using Paxaver are responsible for obtaining the necessary parental consents.

United States — State

Several US states have comprehensive consumer privacy laws. Paxaver complies with each law that applies to the residents of that state. The table below lists the laws that Paxaver currently supports with data separation.

CCPA / CPRA — California

The California Consumer Privacy Act and the California Privacy Rights Act give California residents the right to know, delete, and correct their personal information, and the right to opt out of the sale or sharing of personal information. Paxaver does not sell personal information. Paxaver separates data for California schools and honors all consumer rights requests from California residents.

CPA — Colorado Privacy Act

The Colorado Privacy Act gives Colorado residents the right to access, correct, delete, and port their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. Paxaver separates data for Colorado schools and honors all consumer rights requests from Colorado residents.

VCDPA — Virginia Consumer Data Protection Act

The Virginia Consumer Data Protection Act gives Virginia residents the right to access, correct, delete, and port their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. Paxaver separates data for Virginia schools and honors all consumer rights requests from Virginia residents.

MODPA — Maryland Online Data Privacy Act

MODPA is the Maryland comprehensive consumer privacy law. It limits data collection to what is reasonably necessary to deliver the service a consumer requests, bars the sale of sensitive data, and gives Maryland residents the right to access, correct, and delete their personal data. Paxaver separates data for Maryland schools, limits collection to what is necessary to operate the platform, does not sell personal data, and honors all consumer rights requests from Maryland residents.

Your Rights

Regardless of your jurisdiction, you have the right to:

• Access the personal information Paxaver holds about you.
• Correct inaccurate personal information.
• Delete your personal data, subject to legal retention requirements.
• Receive a copy of your data in a portable, machine-readable format.
• Object to or restrict certain processing of your data.
• Withdraw consent where processing is based on consent.
• Opt out of the sale or sharing of your personal information.

To exercise any of these rights, send an email to feedback@paxaver.com. Paxaver will respond within the timeframe required by the applicable law.

Contact

For questions about privacy, compliance, or data migration, contact Paxaver at feedback@paxaver.com. For security reports, see the Security Policy. For AI governance, see the AI Governance page. For the full privacy policy, see the Privacy Policy.