Utah Student Data Protection Act Vendor Information
Last updated: August 21, 2026
This page is provided for Utah LEAs (school districts, charter schools, and the Utah Schools for the Deaf and the Blind) reviewing ClassMana under Utah Code 53E-9-3, the Student Data Protection Act, and Utah State Board of Education Rule R277-487. It is intended to help a student data manager, information security officer, or purchasing department complete a vendor review, populate a metadata dictionary, and prepare a student data privacy agreement. District-specific agreements or contract addenda can be sent to info@classmana.com.
ClassMana is operated by Dewitters BV, a company registered in Belgium. Utah Code 53E-9-3 does not restrict an education entity to in-state or U.S.-based vendors; it sets requirements for how any third-party contractor handles student data. When ClassMana receives student data from a Utah education entity, ClassMana acts as a third-party contractor under Section 53E-9-301(20) for the limited purpose of providing the ClassMana classroom engagement platform. ClassMana production services and student data are hosted in the United States.
Third-Party Contractor Obligations (Section 53E-9-309)
Exclusive Purpose for Data Use
ClassMana uses personally identifiable student data received under a contract with a Utah education entity strictly for the purpose of providing the contracted product or service within the negotiated contract terms. This includes student login, class rosters, avatars, rewards, powers, quests, quiz grading, progress tracking, teacher dashboards, support, security, troubleshooting, service operation, and legal compliance.
Prohibited Uses
ClassMana does not:
- sell student data;
- collect, use, or share student data in a manner inconsistent with its contract with the education entity; or
- use student data for targeted advertising as defined in Section 53E-9-301(19).
ClassMana displays no third-party advertisements to students and does not build advertising or marketing profiles from student data.
Permitted Uses
Of the uses permitted by Subsection 53E-9-309(4), ClassMana relies only on:
- using student data to allow or improve the operability and functionality of the ClassMana application; and
- adaptive or customized learning behaviour within the product, such as adjusting quests, quizzes, and rewards to a student's progress.
ClassMana does not use student data shared by or collected on behalf of an education entity to market products to parents, does not operate a paid-placement recommendation engine, and does not identify students for higher education institutions or scholarship providers.
Secondary Use
ClassMana can accept contract provisions prohibiting the secondary use of personally identifiable student data, as contemplated by Subsection 53E-9-309(2)(a)(i)(D).
Persons With Whom Student Data May Be Shared
To satisfy Subsection 53E-9-309(2)(a)(i)(B), ClassMana shares student data only with:
- the contracting education entity and its authorized teachers, school officials, and students;
- limited service providers acting on ClassMana's behalf for hosting, infrastructure, email delivery, analytics and error reporting, customer support, and payment processing for school or teacher purchases; and
- law enforcement, as authorized by law or court order, in accordance with Subsection 53E-9-309(3).
Service providers may process student data only as needed to provide their services to ClassMana and are bound by contractual confidentiality and security obligations. The current list is published on our Sub-processors page. ClassMana does not share student data with affiliates for their own purposes.
Deletion at the Request of the Education Entity
Teachers can delete classes, students, and accounts directly in the product. When a class, student, or account is deleted, the related production records are permanently removed. ClassMana will also delete personally identifiable student data at the written request of the education entity, as contemplated by Subsection 53E-9-309(2)(a)(i)(C). Deleted data may remain in encrypted backups for up to 60 days before routine backup rotation removes it.
Return or Deletion at Completion of the Contract
At the completion of a contract that is not renewed, ClassMana will return or delete all personally identifiable student data under the control of the education entity, in accordance with Subsection 53E-9-309(5), subject to any legal retention obligation and to any written parental consent to retain data.
Audit Rights
ClassMana can accept contract provisions setting out how the education entity or its designee may audit ClassMana's compliance with the contract, as contemplated by Subsection 53E-9-309(2)(a)(i)(E).
Termination for a Privacy Violation
ClassMana accepts contract provisions describing the education entity's statutory duty to terminate the contract in the case of a privacy violation under Subsection 53E-9-309(2)(a)(iii). ClassMana will not impose a fee, seek damages, or assert any financial liability against an education entity or government agency that terminates a contract as a consequence of unauthorized usage of student data in violation of a relevant state or federal privacy law.
Student Data Elements
ClassMana may receive or create teacher account information, class names, shortened student display names (typically a first name), student login codes or tokens, class membership, avatar and game-state data, rewards and powers, activity history, quest and objective progress, quiz answers, quiz scores, attempts, timestamps, and technical logs.
ClassMana does not request or require Social Security numbers, criminal or juvenile delinquency records, biometric identifiers or biometric information, student email addresses, telephone numbers, home addresses, social media accounts, health or disability data, or teacher and principal evaluation data. This information can be used by a student data manager when preparing the education entity's student data collection notice and metadata dictionary.
Student Data Ownership and Access
Consistent with Section 53E-9-304(1), ClassMana treats student data as belonging to the student and under the control of the education entity. Parents, students, and individuals acting as a parent should direct requests to access, review, or correct student data to their school or LEA. Teachers can correct most records directly in ClassMana, and ClassMana will reasonably assist the education entity with requests it cannot complete itself.
Expungement
ClassMana supports the education entity's expungement process under Section 53E-9-306. Teachers can permanently delete student records in the product, and ClassMana will act on written expungement requests received from the education entity.
Securing Student Data
In line with Section 53E-9-307 and R277-487, ClassMana maintains and protects stored student data using reasonable data industry best practices, including:
- role-based and least-privilege access controls, with access limited to personnel who need it to operate, support, secure, or improve the service;
- confidentiality obligations for personnel and contractors with access to student data, and an expectation that they understand applicable data privacy requirements before access is granted;
- teacher account authentication and token-based student access;
- encryption of data in transit using TLS/HTTPS and encryption at rest provided by ClassMana's cloud infrastructure and database providers;
- routine encrypted backups;
- logging, monitoring, and documented incident response procedures; and
- a written data security and privacy plan.
Data Breach Notice
ClassMana will promptly investigate any suspected unauthorized release of, or unauthorized access to, personally identifiable student data, and will notify the affected education entity in the most expedient way possible and without unreasonable delay, so that the education entity can meet its own notification duties to students and parents under Section 53E-9-304(2) and R277-487. Specific notification timelines can be agreed in the education entity's contract or data privacy agreement. ClassMana will cooperate with the education entity, the Utah State Board of Education student data privacy team, and law enforcement as needed to protect investigations and affected individuals.
Reports and Investigations
Utah Code 53E-9-309(2)(c) allows any person to report a suspected violation to the Utah State Board of Education student data privacy team, which may open a compliance audit or investigation. ClassMana will cooperate with such an audit or investigation. The state board's contact for student data privacy is privacy@schools.utah.gov.
Related Compliance Information
ClassMana also complies with FERPA, COPPA, and the GDPR. See our Privacy Policy, Terms of Use, Guide for Schools & IT, and Sub-processors. Districts in New York can refer to our New York Education Law 2-d Vendor Information.
Contact
Questions, student data privacy agreements, security questionnaires, and incident notices can be sent to info@classmana.com.