New York Education Law 2-d Vendor Information

Last updated: July 2, 2026

This page is provided for New York educational agencies reviewing ClassMana under New York State Education Law Section 2-d and 8 NYCRR Part 121. It is intended to help districts complete their required Parents' Bill of Rights supplemental information and vendor review materials. District-specific data privacy agreements or contract addenda can be sent to info@classmana.com.

ClassMana is operated by Dewitters BV, a company registered in Belgium. When ClassMana receives student data from a New York educational agency, ClassMana acts as a third-party contractor for the limited purpose of providing the ClassMana classroom engagement platform.

Parent and Student Rights

New York educational agencies are responsible for publishing their own Parents' Bill of Rights for Data Privacy and Security. NYSED provides the official Parents' Bill of Rights guidance.

ClassMana supports those rights as follows:

• Student personally identifiable information is not sold.
• Student personally identifiable information is not used or disclosed for advertising, marketing, profiling, or other commercial purposes unrelated to the educational service.
• Student records are used only to provide, secure, support, and improve the ClassMana service for the educational agency and its authorized teachers and students.
• Parents and eligible students should direct requests to inspect, review, correct, or delete student records to their school or district. ClassMana will assist the educational agency with those requests.
• Parents, eligible students, teachers, or principals may report suspected unauthorized disclosure of protected data to the educational agency. ClassMana will cooperate with the educational agency and NYSED-required incident processes.

Supplemental Contract Information

Exclusive Purposes for Data Use

ClassMana uses student data only to provide the classroom engagement platform, including student login, class rosters, avatars, rewards, powers, quests, quiz grading, progress tracking, teacher dashboards, support, security, troubleshooting, service improvement, and legal compliance.

Data Elements Received or Created

ClassMana may receive or create teacher account information, class names, shortened student display names, student login codes or tokens, class membership, avatar and game-state data, rewards and powers, activity history, quest/objective progress, quiz answers, quiz scores, attempts, timestamps, and technical logs. ClassMana does not require student email addresses, phone numbers, social media accounts, home addresses, or teacher/principal evaluation data.

Subcontractors and Authorized Service Providers

ClassMana uses limited service providers for hosting, infrastructure, email delivery, analytics/error reporting, customer support, and payment processing for teacher or school purchases. Subcontractors are permitted to process protected data only as needed to provide their services to ClassMana and must protect data under contractual confidentiality and security obligations.

Contract Duration

The contract duration is the term of the educational agency's subscription, order, data privacy agreement, or other written agreement with ClassMana. If no separate written term applies, the service continues until the teacher, school, or ClassMana terminates the account or service under the Terms of Use.

Return, Deletion, or Destruction

Teachers can delete classes, students, and accounts in the product. When a class, student, or account is deleted, the related production records are permanently removed. Upon contract expiration or termination, ClassMana will delete or return student data at the educational agency's written direction, subject to legal retention obligations. Deleted data may remain in encrypted backups for up to 60 days before routine backup rotation removes it.

Accuracy Challenges

Parents, eligible students, teachers, or principals should submit accuracy challenges to the educational agency. The teacher or educational agency can correct many records directly in ClassMana, and ClassMana will reasonably assist with corrections the educational agency cannot complete directly.

Storage Location

ClassMana production services are hosted by Vercel and other cloud service providers. Current hosting is in the United States. Detailed infrastructure information may be limited or redacted when needed to protect security.

Security Safeguards

ClassMana uses administrative, operational, and technical safeguards designed to align with the NIST Cybersecurity Framework, including access controls, least-privilege access, confidentiality obligations, teacher account authentication, token-based student access, encrypted transport, encryption at rest, routine backups, monitoring, and incident response procedures.

Encryption

ClassMana protects data in transit with TLS/HTTPS and protects stored data using encryption at rest provided by its cloud infrastructure and database providers.

Training

Personnel and contractors with access to student data are required to understand confidentiality obligations and applicable data privacy requirements before receiving access. Access is limited to people who need it to operate, support, secure, or improve the service.

Incident Response and Notice

ClassMana will promptly investigate suspected breaches or unauthorized releases of protected data. For New York educational agency contracts subject to 8 NYCRR Part 121, ClassMana will notify the educational agency in the most expedient way possible and without unreasonable delay, and no later than seven calendar days after discovery of a breach or unauthorized release of personally identifiable information. ClassMana will cooperate with the educational agency and law enforcement to protect investigations and affected individuals.

Data Security and Privacy Plan

For New York educational agencies, ClassMana's data security and privacy plan includes the following commitments:

• Implement applicable federal, state, and local privacy and security contract requirements over the life of the agreement.
• Comply with the educational agency's data security and privacy policy when provided to ClassMana and accepted as part of the agreement.
• Limit internal access to protected student data to authorized personnel and service providers who need access to provide the contracted service.
• Use protected data only for purposes explicitly authorized by the agreement and this vendor information.
• Not sell student data or use or disclose it for advertising, marketing, or other unrelated commercial purposes.
• Require subcontractors that process protected data to protect that data under confidentiality and security obligations consistent with ClassMana's obligations.
• Maintain administrative, operational, and technical safeguards for the confidentiality, integrity, and availability of protected data.
• Protect protected data with encryption while in motion and at rest.
• Manage suspected data security and privacy incidents through investigation, containment, mitigation, notice to the educational agency, and cooperation with legally required follow-up.
• Delete, return, or transition protected data when the agreement terminates or expires, as directed by the educational agency and subject to legal retention obligations.

No Teacher or Principal Evaluation Data

ClassMana is a classroom engagement tool. It is not designed to receive annual professional performance review data, teacher evaluation data, or principal evaluation data. If a district believes a planned use would involve teacher or principal data protected by New York Education Law Section 2-d, contact ClassMana before using the service for that purpose.

Contact

Questions, district data privacy agreements, security questionnaires, and incident notices can be sent to info@classmana.com.