United States State Privacy Notice

1. Purpose and scope of this notice

1.1 What this notice does

This notice supplements our Privacy Policy. It sets out the disclosures and rights required by the comprehensive consumer privacy laws of United States states, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”).

Where this notice and the Privacy Policy differ for a resident of a state covered here, this notice governs for that person.

1.2 Which platforms and which entity

This notice covers Classe365, our student information system, learning management system and CRM for education institutions, and Hiree365, our campus recruitment and employability platform. It also covers the classe365.com marketing website.

Customers located in the United States contract with 365 Software, LLC, a Delaware limited liability company, registered office 131 Continental Dr, Suite 305, Newark, DE 19713, New Castle County, United States, registered agent Legalinc Corporate Services Inc. Customers located outside the United States contract with Sprout On Web Pty Ltd, ABN 72 138 602 418, of 22 Palm Street, St Ives, NSW 2075, Australia. Support and engineering are provided 24/7 by Classe365 group staff in Australia, India, the Philippines, Spain and the United States.

Who is the controller (the “business”) for the information described in this notice:

• Prospective customers and customers located in the United States, including their named contacts, account, billing and support records: 365 Software, LLC.

• Website visitors and marketing contacts who are not prospective or existing United States customers: Sprout On Web Pty Ltd.

• Information inside the platform: the institution or corporate customer is the business or controller, and we act as its service provider or processor. See section 2.

1.3 Which state laws this notice addresses

This notice is written to meet the requirements of the comprehensive privacy laws now in force in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. We update this notice as the law requires.

Some of the rights described below are not available in every state, and some states use different words for the same idea — “consumer” in one law, “resident” in another; “sale” defined broadly in California and narrowly elsewhere. Where a right depends on your state, this notice says so. Where a state gives you a right that this notice does not describe, that right still applies to you, and asking us for it is enough.

1.4 Sector-specific laws still apply

Comprehensive state privacy laws are not the only rules that govern student information. The Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA) and state student-data-protection statutes also apply, and in several cases those laws exempt data from the comprehensive state laws precisely because they already regulate it. Our FERPA position is set out in section 10 and in the Privacy Policy; our COPPA position is set out in the Children’s Privacy Policy.

2. Our two roles: service provider and controller

Everything in this notice depends on which of two roles we are in.

2.1 Service provider and processor to institutions

For personal information held inside the platform — student and learner records, enrolment data, grades, attendance, timetables, fee records, coursework, candidate profiles and placement records — the institution or corporate customer is the business or controller, and we are its service provider or processor.

In that role:

• We process personal information only to perform the services set out in our written contract with the institution.

• We do not retain, use or disclose it for any purpose other than performing those services, and we do not use it for a commercial purpose of our own.

• We do not sell it and we do not share it for cross-context behavioural advertising.

• We do not combine it with personal information we receive from another source, except as the applicable law permits a service provider to do.

• Our contract with each institution restricts our use of personal information to providing the services, consistent with the requirements state law places on service providers and processors.

• Under FERPA, we act as a school official with a legitimate educational interest, under the direct control of the institution.

Consumer rights requests about that information are directed to the institution. Section 8 explains how we route them.

2.2 Business and controller in our own right

We are the business or controller for a narrow category of information that is genuinely ours:

• account and administrative records for an institution’s contract, including named contacts and billing details;

• support correspondence sent to us directly;

• information about visitors to classe365.com and about prospective customers who request a demonstration, download material or start a free trial;

• security, audit and system logs we generate;

• our own business marketing and CRM records about professional contacts.

For this information you can come straight to us, and we will handle your request ourselves.

2.3 Why the distinction matters

If you are a student, a parent or a candidate, the great majority of information about you sits in your institution’s tenant under its control. We cannot delete or alter a student’s education record on our own initiative — doing so would override the school and could destroy a record the school is legally required to keep. If you are a business contact, none of that applies and we act on your request directly.

3. Categories of personal information we collect

The table below uses the categories set out in the CCPA at Cal. Civ. Code § 1798.140(v). We collect these categories from the sources described in section 4, for the purposes described in section 5. We have collected each of these categories within the twelve months preceding the date of this notice.

We do not collect a government-issued identifier in order to provide the platform. Where an institution configures its own admission or enrolment form to collect one, that identifier is treated as personal information and held under the retention schedule in our Privacy Policy.

4. Where we get personal information

• From you, when you create or use an account, complete a form, contact support, request a demonstration, start a free trial, or subscribe to a mailing list.

• From your institution or employer, when it uploads or enters records, imports data from another system, or configures the platform.

• From your device, automatically, through cookies and similar technologies on classe365.com, and through server logs generated by using the platform.

• From our service providers, such as payment processors confirming a transaction, or support tooling recording a conversation you started.

We do not buy personal information from data brokers to enrich records.

5. Why we collect it — business and commercial purposes

We use personal information for the following purposes, which correspond to the “business purposes” recognised by state law:

1. Providing, operating and maintaining Classe365 and Hiree365 for the institution that has engaged us.

2. Running admissions, enrolment, timetabling, attendance, assessment, grading, progression, fees, learning delivery, campus recruitment and placement.

3. Providing customer support, diagnosing and fixing faults, and restoring data.

4. Auditing interactions with the service and maintaining audit trails for institutions.

5. Detecting and preventing security incidents, fraud and malicious or illegal activity, and protecting the safety of users.

6. Debugging to identify and repair errors that impair intended functionality.

7. Short-term, transient use, including for non-personalised presentation of content within the platform.

8. Internal research for technological development, limited to personal information we control and subject to the AI limits in section 11.

9. Verifying and improving the quality and safety of the service.

10. Administering and billing the customer relationship, and collecting payment.

11. Business-to-business marketing to professional contacts at current and prospective customer organisations.

12. Complying with our legal obligations, and establishing, exercising or defending legal claims.

6. Disclosure of personal information

6.1 We do not sell personal information and we do not share it for cross-context behavioural advertising

We do not sell personal information, and we have not sold personal information in the twelve months preceding the date of this notice.

We do not share personal information for cross-context behavioural advertising, as that term is defined in the CCPA, and we have not done so in the twelve months preceding the date of this notice.

We do not sell or share the personal information of any consumer we know to be under 16 years of age. Because we do not sell or share personal information at all, we do not offer a “Do Not Sell or Share My Personal Information” mechanism — there is nothing for it to switch off. We do not engage in targeted advertising to students, and we do not profile individuals in furtherance of decisions that produce legal or similarly significant effects, other than as described in section 11.

6.2 Who we disclose personal information to, for a business purpose

We disclose personal information to the following categories of recipient, for the business purposes set out in section 5.

Service providers and processors that may receive student or candidate data:

AI model providers (AI add-on only):

The AI model providers receive data only where an institution has taken up the optional AI add-on, under business terms that do not permit them to use our customers’ data to train their models.

Each of these is engaged under a written contract that restricts its use of personal information to providing its services to us, except that payment processors may also use payment information for their own fraud-prevention and legal-compliance purposes under their own terms.

Providers that never receive student or candidate data:

Google Analytics, Semrush, Mailchimp and ActiveCampaign operate on the classe365.com marketing website only. They never receive student or candidate records from the platform. They are used for website analytics, search performance analysis, and email to business contacts. They have no access to the authenticated platform or to any institution’s tenant.

Optional services an institution enables and contracts for itself:

• SMOWL — online quiz proctoring, contracted by the institution directly under SMOWL’s own terms.

• Zapier — customer-configured automation, where the customer decides what data flows to it.

These are not our service providers. When an institution turns one on, that institution takes responsibility for the provider’s handling of the data it receives.

Group support team: we provide 24/7 follow-the-sun support through support and engineering staff who are employees of the Classe365 group, located in Australia, India, the Philippines, Spain and the United States. Those staff may access customer data, including student data, remotely and only when needed to resolve a support request or fix a fault. Customer data is hosted on Amazon Web Services and is not stored in those locations. Access is under role-based least-privilege access controls, audit logging, written confidentiality obligations, intra-group data transfer agreements and, for personal data from the European Economic Area, the United Kingdom or Switzerland, the transfer mechanisms set out in our Personal Data Processing Agreement. We state this plainly because institutions need it for their own assessments.

Other recipients: the institution that controls the record; professional advisers under confidentiality; a party acquiring our business or part of it, subject to this notice continuing to apply; and government or regulatory bodies where we are legally required to disclose. Where we act as service provider and the law permits, we notify the institution before disclosing its data.

6.3 Categories disclosed

In the twelve months preceding the date of this notice, we disclosed for a business purpose the categories of personal information marked “Yes” or “Limited” in the table at section 3 — that is, categories A, B, C, D, F, G, H, I, J, L and the limited inferences in K — as follows:

• Categories A, B, C, D, F, G, H, I, J, K and L: hosting (Amazon Web Services) and our group support and engineering staff.

• Categories A, B, D and F: support messaging (Intercom) and engineering diagnosis (Atlassian).

• Categories A, B and D: payment processors (Stripe and PayPal).

• Categories A, B, C, F, I, J, K and L, where the institution has taken up the AI add-on: AI model providers (OpenAI, Anthropic and Google), to the extent that data is used in agent automation and workflow features.

• Categories A, F and G (website visitors and business contacts only): website analytics and email service providers (Google Analytics, Semrush, Mailchimp and ActiveCampaign).

• All categories: the institution that controls the record, professional advisers, a successor in a corporate transaction, and authorities where required by law.

We disclosed no personal information for monetary or other valuable consideration.

7. Sensitive personal information

Several state laws define a category of sensitive personal information or sensitive data, which typically includes government-issued identifiers, precise geolocation, account log-in credentials, racial or ethnic origin, religious belief, health information, sexual orientation, citizenship or immigration status, genetic and biometric data, and the personal data of a known child.

Our position:

• We do not collect or process biometric identifiers. Classe365 and Hiree365 do not themselves collect, store or process biometric identifiers — including fingerprints, handprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates or faceprints — and do not perform facial or voice recognition. Institutions may choose to enable SMOWL, a third-party proctoring service, which they contract with directly; any biometric processing by SMOWL occurs under SMOWL’s own terms and privacy policy, not ours.

• We do not collect precise geolocation.

• We do not require a government-issued identifier to provide the platform. Where an institution configures its own form to collect one, we hold it as personal information under our published retention schedule.

• We hold account credentials in the form of a username and a hashed password, because authentication requires it.

• We hold health, disability, accessibility and similar information only where an institution records it in a student or learner record, and only on the institution’s instructions.

• We hold personal data of known children where an institution enrols them. This is governed by the Children’s Privacy Policy.

We use sensitive personal information only to perform the services, to secure accounts, and for the other purposes state law permits without an obligation to offer a limitation right. We do not use or disclose sensitive personal information to infer characteristics about anyone. Because our use is confined to those permitted purposes, the CCPA right to limit the use of sensitive personal information does not arise; if you nonetheless ask us to limit such use, we will treat it as a request under section 8 and respond.

8. Your rights and how to exercise them

8.1 The rights

Depending on your state of residence, you have some or all of the following rights.

1. Right to know. To know the categories of personal information we have collected about you, the categories of source, the business or commercial purpose for collecting it, the categories of third party to whom it is disclosed, and the specific pieces of personal information we hold.

2. Right to access and to obtain a copy. To receive a copy of the personal information you provided to us, in a portable and, where technically feasible, readily usable format that allows you to transmit it to another entity without hindrance.

3. Right to delete. To request deletion of personal information we hold about you, subject to the exceptions in section 8.6.

4. Right to correct. To request correction of inaccurate personal information, taking into account the nature of the information and the purpose of processing it.

5. Right to opt out of sale, sharing for targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not sell personal information and we do not share it for cross-context behavioural or targeted advertising, so there is nothing to opt out of. Where a state gives an opt-out from profiling of that kind, our position is set out in section 11: AI outputs are advisory and decisions about students remain with the institution and its staff.

6. Right to limit the use of sensitive personal information, where a state provides it. See section 7.

7. Right against discrimination. We will not deny you goods or services, charge you a different price, provide a different level or quality of service, or retaliate in any way because you exercised a privacy right.

8. Right to appeal, where the applicable state law provides one. See section 8.7.

9. Right to opt out of automated decision-making, where the applicable state law provides one and the decision produces a legal or similarly significant effect. No such decision is made without human review.

10. Right to a list of third parties. Residents of Oregon and Minnesota may request a list of the specific third parties to which we have disclosed their personal data, and Minnesota residents may question the result of profiling and ask what could be done differently. Where the profiling is performed for an institution, we will route the request to it.

We honour universal opt-out mechanisms, including Global Privacy Control, where a state law requires us to and where a browser sends the signal to classe365.com. We do not sell or share personal information, and we run no advertising or retargeting pixels on classe365.com. Where a browser sends Global Privacy Control to classe365.com, we also treat it as an opt-out of non-essential cookies, as described in our Cookie Policy.

8.2 How to make a request

If the information is held in the platform by your institution, contact the institution — its registrar, administrator, student services team or privacy contact. It controls the record and can act on it directly. This is almost always faster.

If you deal with us directly — as a business contact, a website visitor, a prospective customer, or someone who has written to our support team — email clientservice@classe365.com. Put “US privacy request” in the subject line and tell us:

• your full name and the email address you use with us;

• which right you are exercising;

• your state of residence;

• if the request concerns an institution, which one, and in what capacity you are connected to it.

You may also write to us by post at 365 Software, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Requests by post take longer only because the post does; we treat the request as received when it reaches us.

There is no charge for making a request. We may charge a reasonable fee, or decline, where a request is manifestly unfounded, excessive or repetitive, and we will tell you why.

8.3 How we verify a request

We must be reasonably certain that you are who you say you are before we act, particularly on a request to delete, correct or receive specific pieces of personal information. We verify by matching information you give us against information already in our records.

• For a request to know categories, we generally ask you to confirm two pieces of information we already hold.

• For a request for specific pieces of personal information, deletion or correction, we apply a higher standard and generally ask you to confirm three, and to confirm the request from the email address associated with the account.

• For a correction request, we may ask for documentation supporting the correct value, and we will consider the total of the information we hold in deciding whether the existing record is inaccurate.

We do not require a government-issued identity document, and we do not create a record of one. We use information supplied for verification only to verify the request and to keep the records the law requires. We delete it once those purposes are met. If we cannot verify you to the standard the law requires, we will tell you, explain why, and treat a request to know as a request for categories only where that is permitted.

8.4 Authorised agents

You may use an authorised agent to make a request on your behalf.

• The agent must provide written permission signed by you, or proof of a valid power of attorney.

• We may contact you directly to confirm that you gave permission, and we may ask you to verify your own identity with us.

• Where the agent is a business, it must be registered with the California Secretary of State if California law requires it to be.

• A parent or legal guardian may make a request on behalf of a minor child, and we may require proof of the relationship. Where the child’s record is held by an institution, we will route the request as described in section 8.5.

We will not act on an agent request that lacks these elements, and we will tell the agent what is missing rather than simply refusing.

8.5 How requests are routed when we act as service provider

If you send us a request about information held inside an institution’s tenant:

1. We acknowledge your request and identify the institution concerned.

2. We forward the request to that institution without undue delay, because state law makes the institution — as the business or controller — responsible for deciding it.

3. We tell you that we have forwarded it and who will respond.

4. We do not delete, correct or disclose records inside an institution’s tenant on our own initiative. Doing so would override the institution and could alter or destroy an education record it is required to maintain.

5. We provide the institution with reasonable assistance to respond, taking into account the nature of the processing and the information available to us.

Where we are the business or controller, we handle the request ourselves and none of the above applies.

8.6 When we may decline

We may decline a request, in whole or in part, where the law permits — for example where:

• we cannot verify your identity to the required standard;

• the information is subject to an exemption, including personal information regulated by FERPA, COPPA, the Gramm-Leach-Bliley Act or HIPAA, or information about you in your capacity as an employee or job applicant of a business, to the extent a state law exempts it;

• retention is required to comply with a legal obligation, including tax and accounting record-keeping;

• the information is needed to complete a transaction, provide a service you requested, detect security incidents, protect against fraud or illegal activity, or exercise or defend legal claims;

• deletion would require us to override an institution’s instruction as controller of an education record.

Where we decline, we will tell you which exception we are relying on, and we will still comply with the rest of the request.

8.7 Appeals

Where the applicable state law provides an appeal right — which most state comprehensive privacy laws other than California and Utah do — you may appeal a refusal by replying to our response, or by emailing clientservice@classe365.com with “Privacy appeal” in the subject line, within a reasonable period after our decision. Tell us what you disagree with.

An appeal is reviewed by someone who was not responsible for the original decision. We will respond in writing within 45 days of receiving the appeal, explaining the outcome and our reasons. Where your state law permits an extension, we may extend by the additional period it allows and will tell you within the first 45 days. If we deny the appeal, we will give you a method of contacting your state Attorney General to submit a complaint, and for California residents the contact details of the California Privacy Protection Agency.

9. Response timeframes

Requests to know cover the twelve-month period preceding the request unless the applicable state law requires or permits a longer period, in which case we apply the longer period.

10. Student data, FERPA and advertising

Student information deserves its own statement, because it is the reason most of our customers read this notice.

1. We act as a school official with a legitimate educational interest under the FERPA school official exception, under the direct control of the institution.

2. We use education records only to provide the service, on the institution’s instructions.

3. We do not use education records for advertising, and we do not sell them. There is no advertising inside the authenticated platform.

4. We do not use education records to train shared AI models. See section 11.

5. We do not build advertising or marketing profiles from student data, and we do not use it to construct audiences or lookalike segments.

6. Directory information is designated by the institution, which also controls opt-outs through the platform. We do not designate directory information and we do not disclose it on our own initiative.

7. Parents and eligible students exercise inspection, correction and hearing rights through the institution, and we support the institution in fulfilling them.

8. Children under 13 are covered by our Children’s Privacy Policy, which sets out our position under the FTC’s COPPA Final Amendments (90 FR 16918, published 22 April 2025, effective 23 June 2025, compliance date 22 April 2026), including the institution’s authorisation of our collection and use of children’s information for its educational purpose under the FTC’s guidance on school authorisation, the separate authorisation the institution gives for disclosure to our AI model providers when it activates the AI add-on, how parents exercise their rights through the institution, our published retention schedule and our written children’s information security program. We do not sell children’s data, do not serve targeted advertising to children, and do not build advertising profiles.

9. We do not collect audio recordings of children’s voices.

10. Hiree365 has a minimum age of 16 and is not available to anyone under 16.

11. Artificial intelligence and profiling

We do not use customer, student or candidate data to train, fine-tune or improve any general-purpose or shared AI model. Where a feature uses a model that learns from data, that model is trained only on that customer’s own data — it is per-tenant — and is used only for that customer. Data is never pooled across customers and is never used to improve the service for other customers.

AI features are available only as an optional add-on module. If an institution has not taken up the add-on, no AI features are active and no data is processed by AI. Where it is in use, the add-on may include an AI chat assistant, an agent automation and workflow engine, grading analysis, attendance analysis, attrition tracking, behaviour analytics, a writing assistant and AI plagiarism checking. Institutions control AI by choosing whether to take the add-on, and may ask us to switch specific features off. Agent automation and workflow features use general-purpose AI models provided by OpenAI, Anthropic and Google, accessed through their business API services, under terms that do not permit the provider to use our customers’ data to train its models. Grading analysis, attendance analysis, attrition tracking and behaviour analytics use small language models hosted in our own Amazon Web Services environment, and that data does not leave our hosting. When an institution’s data is deleted at the end of its subscription, its per-tenant models are deleted with it. We design our AI features so that users can recognise AI-generated output and know when they are interacting with the AI chat assistant. Our AI features are not designed to infer the emotions of students, learners, candidates or staff, and we do not use AI for any practice prohibited by Article 5 of the EU AI Act.

All AI outputs are advisory. Decisions about students remain with the institution and its staff. No automated decision produces a legal or similarly significant effect without human review. Where a state law gives a right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, we will respond to it in accordance with that law, and route it to the institution where the institution controls the feature.

Full detail is in the AI Use and Transparency Statement.

12. Retention

We publish our retention periods rather than describing them in general terms.

Personal information in categories A–L held in an active customer’s platform is kept for the life of the subscription and deleted as shown above. Commercial information (category D) and billing identifiers are kept for as long as tax and accounting law requires. Internet activity (category F) in server and security logs is kept for 30 days. Marketing contact data is kept for 36 months from last engagement.

We take daily backups and retain each daily backup for 7 days on a rolling basis, which gives a seven-day restore window. Because of that window, a deleted record persists in backups for no more than 7 days. On termination, backups are deleted with all other customer data within 30 days. We retain financial and tax records for the period required by law, which may be longer, and we retain records subject to a legal hold until the hold is lifted.

13. Security

Personal information is protected by encryption in transit using TLS, encryption at rest, network segregation, least-privilege access control, an OWASP-aligned secure development lifecycle, daily backups, DDoS protection and monitoring, on Amazon Web Services infrastructure. We maintain a written children’s information security program with a designated coordinator, an annual risk assessment, documented safeguards, sub-processor due diligence, and annual testing and review.

A SOC 2 Type II audit is in progress and is expected to complete in December 2026; we do not hold a report today and do not claim one. We do not hold ISO 27001 certification and do not claim one.

If we become aware of a breach affecting customer data, we notify the affected customer within 24 hours of becoming aware of it.

14. Notice at collection

For California residents, this notice serves as our notice at collection. At or before the point of collection, we collect the categories of personal information listed in section 3, for the purposes listed in section 5, and retain them for the periods listed in section 12. We do not sell personal information and we do not share it for cross-context behavioural advertising. A link to this notice appears on classe365.com, including on forms that collect personal information.

15. Changes to this notice

We review this notice from time to time, and at least every 12 months where California law requires it, and update it when the law or our practices change. Where a change materially affects how we handle personal information, we will give at least 30 days’ notice before it takes effect, by email to institutional account contacts and by a notice on our website, unless a shorter period is required to comply with law or to address a security risk. Minor corrections take effect when published. Each version carries a “Last updated” date and an “Effective” date at the top. The current version was published on 22 September 2026 and takes effect on 22 October 2026.

16. Contact us

Privacy requests and enquiries: clientservice@classe365.com Support: clientservice@classe365.com Accessibility line: +61 2 9472 5000

By post — United States: 365 Software, LLC 131 Continental Dr, Suite 305 Newark, DE 19713 United States

By post — all other locations: Sprout On Web Pty Ltd 22 Palm Street St Ives, NSW 2075 Australia

If you are not satisfied with how we have handled your request, you may complain to your state Attorney General. California residents may also complain to the California Privacy Protection Agency.

Classe365 and Hiree365 are operated by 365 Software, LLC (United States customers) and Sprout On Web Pty Ltd (all other customers), with 24/7 support and engineering provided by our group team in Australia, India, the Philippines, Spain and the United States.