Québec Law 25 Vendor Information
Last updated: August 28, 2026
This page is provided for Québec centres de services scolaires, school boards, and private schools reviewing ClassMana under Law 25 (the Act to modernize legislative provisions as regards the protection of personal information) and the Act respecting access to documents held by public bodies and the protection of personal information (CQLR, c. A-2.1). It is meant to give a responsable de la protection des renseignements personnels, an information security officer, or a purchasing department the information needed to complete an évaluation des facteurs relatifs à la vie privée (ÉFVP) and a written agreement. Institution-specific agreements or addenda can be sent to info@classmana.com.
ClassMana is used by many schools across Québec, and Québec is one of our largest markets. We are happy to work through a service centre's privacy review, complete security questionnaires, and sign a written agreement.
About the Vendor
- Legal entity: Dewitters BV
- Jurisdiction: Belgium (European Union)
- VAT number: BE 0731.791.853
- Contact: info@classmana.com
As an enterprise carrying on activities in Québec, Dewitters BV is also subject to the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1). As an EU company, Dewitters BV is subject to the GDPR, which imposes an equivalent set of obligations regarding purpose limitation, data minimization, security, retention, individual rights, and breach notification.
Personal Information Handled
ClassMana is designed to work with as little personal information as possible. The table below is intended to be pasted directly into an ÉFVP inventory.
| Category | Examples | Concerns |
|---|---|---|
| Teacher account | Email address, display name, password hash, language, subscription state | Teacher (adult) |
| Class information | Class name, class settings, school or organisation name | Not personal |
| Student identification | Shortened display name (first name, optionally a last initial) | Student |
| Student access | Generated login code or token | Student |
| Game state | Avatar, health, experience, rewards, powers, pets, inventory | Student (pseudonym) |
| Classroom activity | Behaviour records, quest and objective progress, timestamps | Student (pseudonym) |
| Assessment | Quiz answers, scores, attempts | Student (pseudonym) |
| Technical | Server and error logs, IP address at request time, session cookies | Teacher and student |
| Billing | Purchaser name, billing address, invoice records (held by Paddle) | Teacher or school |
ClassMana does not request or require student email addresses, student phone numbers, home addresses, dates of birth, student ID numbers, social insurance numbers, health information, biometric data, geolocation, photographs of students, disciplinary files, or teacher evaluation data.
Students do not create accounts with personal contact details. A student signs in with the display name their teacher entered plus a login code generated by ClassMana. Outside the context of the teacher's own class list, the data we hold about a student is effectively pseudonymous.
Purposes
Personal information is used only to provide the ClassMana classroom engagement platform: student sign-in, class rosters, avatars, rewards, powers, quests, quiz grading, progress tracking, teacher dashboards, customer support, security, troubleshooting, service operation and improvement, and legal compliance. It is not used for any other purpose.
Storage Location and Communication Outside Québec
Under section 70.1 of the Access Act, a public body must assess the privacy implications before personal information is communicated outside Québec, and the communication must be the subject of a written agreement. The information below supports that assessment.
- ClassMana production services and the primary database are hosted in the United States by Vercel Inc.
- Dewitters BV, the controller of the service, is established in Belgium (European Union) and operates under the GDPR.
- Payment processing for teacher and school purchases is handled by Paddle.com Market Ltd. in the United Kingdom. Paddle receives billing information only. It receives no student data.
- The full list of service providers, what each is used for, and where each stores data is published on our Sub-processors page.
- The information transferred is limited to the categories listed above. It contains no direct student identifiers, no contact details, and no sensitive information within the meaning of section 59 of the Access Act.
- Dewitters BV will sign a written agreement covering the communication, including confidentiality, purpose limitation, security measures, sub-contracting, incident notification, and return or destruction at the end of the contract.
Service providers act on ClassMana's behalf under contracts that limit processing to what is necessary to deliver their service, as required by section 67.2 of the Access Act. They may not use the information for their own purposes, sell it, use it for advertising, or re-identify de-identified data.
Confidentiality by Default and No Profiling
- ClassMana applies the highest level of confidentiality by default. A class is private to its teacher and the students in it. Nothing is public.
- ClassMana contains no functions that identify, locate, or profile a student. There is no geolocation, no behavioural advertising profile, and no tracking across other websites.
- There is no open chat, no messaging with strangers, no global forums, and no public student profiles.
- No decision affecting a student is made exclusively on the basis of automated processing. Teachers award and remove points themselves, and every automatic rule (such as health loss) is configured and can be disabled by the teacher.
- ClassMana displays no third-party advertising to students.
Consent and Students Under 14
Under Québec law, consent for a person under 14 is given by the holder of parental authority. ClassMana is provided to the student through the school, which decides on the lawful basis for the use of the tool and handles any parental information or consent required by its own policies. ClassMana does not contact students or parents directly and does not collect personal information from students outside of the classroom use set up by their teacher.
Retention and Destruction
- Teachers can delete individual students, classes, and their own account directly in the product. Deleting removes the related production records permanently.
- Deleted data may persist in encrypted backups for up to 60 days before routine backup rotation removes it.
- At the end of a subscription or written agreement, ClassMana will delete or return the personal information at the institution's written direction, subject to legal retention obligations for accounting records.
Access, Rectification, and Portability
Requests from a parent, a student, or a teacher regarding personal information held about a student should be directed to the school or service centre, which holds the link between the display name and the actual student. Teachers can correct most records directly in ClassMana, and ClassMana will assist the institution with any request it cannot complete on its own, including providing the data in a structured, commonly used technological format.
Security Safeguards
ClassMana uses administrative, organisational, and technical safeguards proportionate to the sensitivity of the information, including:
- Encryption in transit with TLS/HTTPS and encryption at rest for stored data.
- Teacher authentication with hashed passwords, and token-based student access with no reusable credentials shared across classes.
- Least-privilege access. Only personnel who need access to operate, support, or secure the service have it, and all are bound by confidentiality obligations.
- Routine encrypted backups, monitoring, and logging.
- A documented incident response procedure.
Confidentiality Incidents
If ClassMana becomes aware of a confidentiality incident affecting personal information belonging to a Québec institution, ClassMana will notify the institution promptly and without unreasonable delay so that it can record the incident in its register and, where the incident presents a risk of serious injury, notify the Commission d'accès à l'information and the persons concerned. ClassMana will provide the information the institution needs for that assessment and will cooperate with the follow-up.
No Sale and No Secondary Use
ClassMana does not sell personal information, does not share it for behavioural advertising, does not use student data to build commercial profiles, and does not use it for any purpose unrelated to providing the classroom platform.
Service in French
ClassMana is fully available in French, including the teacher dashboard, the student interface, the documentation, and customer support. Written communication, quotes, and invoices can be provided in French.
Web Filter Categorization
Some school networks block ClassMana automatically because of a default "Games" filtering rule rather than because of an
actual privacy decision. ClassMana should be categorized as Education, Educational Games, and For Kids. See the
Guide for Schools & IT for the details an IT department needs to allow classmana.com and
*.classmana.com.
Contact
Privacy questionnaires, ÉFVP support, written agreements, security reviews, and incident notices can be sent to info@classmana.com. We answer in French or English.