Privacy Policy
ReviewED Solutions Corporation | Last updated: July 2026
Effective date: July 2026
ReviewED Solutions Corporation ("ReviewED," "we," "us," or "our") is committed to protecting the privacy and security of personal data entrusted to us. This Privacy Policy explains how we collect, use, disclose, and safeguard information when schools, administrators, coordinators, teachers, and other authorised adult users (collectively, "Users" or "you") use the ReviewED platform, website, and related services (the "Service").
This Privacy Policy applies to information we collect through the Service. It does not apply to information collected by third-party websites or services that may link to or be accessible from the Service.
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, please do not use the Service.
1. Key Definitions
For purposes of this Privacy Policy:
- "Personal Data" means any information relating to an identified or identifiable natural person, as defined under the Philippine Data Privacy Act of 2012 (RA 10173), the EU General Data Protection Regulation (GDPR), and other applicable data protection laws.
- "School Data" means all data, documents, and information uploaded by or on behalf of a School to the Service, including User account data and Student Data.
- "Student Data" means any Personal Data within School Data that relates to an identified or identifiable student, including academic performance records, assessment results, and enrollment data.
- "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, dissemination, erasure, or destruction.
- "Data Controller" means the entity that determines the purposes and means of processing Personal Data. For School Data, the School is the Data Controller.
- "Data Processor" means the entity that processes Personal Data on behalf of the Data Controller. ReviewED acts as a Data Processor for School Data.
2. Information We Collect
2.1 Information Provided by the School
- School Profile Data: School name, physical address, contact information, enrollment figures, evaluation bodies, curricula offered, and school leadership details.
- User Account Data: Names, professional email addresses, job titles/roles (administrator, coordinator, teacher), and account credentials of Authorised Users. Students do not have accounts on the Service.
- School Documents & Evidence: Files, documents, self-study reports, action plans, policies, meeting minutes, survey results, and other materials uploaded by Authorised Users for evaluation preparation and school improvement purposes.
- Student-Related Data: Student academic performance records, assessment results, enrollment statistics, and other student-related information uploaded by Authorised Users for evaluation evidence gathering. Students cannot directly input or access data on the Service.
- Billing Information: Payment details, billing address, and transaction records. Payment card information is processed directly by our payment processor (Stripe) and is not stored on ReviewED's servers.
2.2 Information Collected Automatically
- Usage Data: Information about how the Service is accessed and used, including login times, features used, pages visited, actions taken, and session duration.
- Technical Data: Internet Protocol (IP) address, browser type and version, device type, operating system, referring URLs, and diagnostic data.
- Cookies and Similar Technologies: As described in Section 8 (Cookies & Tracking Technologies).
2.3 Information from Third Parties
We may receive information about Users or Schools from third-party integrations (such as learning management systems) when the School has authorised such integration. We process this information in accordance with this Privacy Policy and the applicable integration terms.
3. Information We Do NOT Collect
ReviewED is designed with data minimisation principles in mind. We do not:
- Collect sensitive personal information such as government-issued identification numbers (beyond what is required for billing), biometric data, genetic data, or health/medical records;
- Collect precise geolocation data from Users' devices;
- Collect personal data directly from students — students cannot create accounts, log in, or input data on the Service;
- Collect personal data from children under 13 directly — all student-related data is uploaded by adult Authorised Users acting on behalf of the School;
- Request or require student email addresses, phone numbers, or social media profiles;
- Use web beacons, tracking pixels, or third-party advertising networks on pages that display or process Student Data;
- Collect or use School Data or Student Data for any purpose unrelated to providing the Service.
4. How We Use Your Data
| Purpose | Category of Data | Examples |
|---|---|---|
| Service Delivery | All categories | Providing evaluation analysis, readiness assessments, evidence management, report generation, action plan tracking, and related platform features. |
| Account Management | User Account Data, Billing | Managing user access, authentication, role-based permissions, billing, and subscription administration. |
| Product Improvement | Usage Data, Technical Data (de-identified/aggregated) | Analysing platform usage patterns to improve features, fix bugs, and develop new functionality. We do not use Student Data for product improvement beyond aggregated, anonymised metrics. |
| Communications | User Account Data | Sending service-related communications, including billing notices, maintenance updates, security alerts, feature announcements, and support responses. |
| Security & Compliance | All categories | Monitoring for security threats, investigating potential violations of our Terms of Service, complying with legal obligations, and responding to lawful requests from authorities. |
| Research & Analytics | Usage Data, Technical Data (de-identified/aggregated) | Conducting aggregated analytics to understand educational trends and improve the Service. Any published research uses only anonymised, aggregate data that cannot identify any individual school, user, or student. |
We will not use School Data or Student Data for purposes other than those stated above without the School's prior written consent.
5. Legal Basis for Processing
| Legal Basis | When It Applies |
|---|---|
| Performance of Contract | Processing necessary to provide the Service to the School under our Terms of Service and School Agreement (e.g., hosting School Data, providing platform features, managing accounts). |
| Legitimate Interests | Processing necessary for our legitimate interests in improving and securing the Service, using de-identified or aggregated data, provided those interests are not overridden by the data subject's rights. |
| Legal Obligation | Processing required to comply with applicable laws and regulations (e.g., tax record-keeping, responding to lawful legal requests). |
| Consent | Where we rely on consent (e.g., for optional marketing communications), you may withdraw consent at any time. |
Where we process Student Data as a Data Processor on the School's instructions, the School (as Data Controller) is responsible for establishing its own legal basis for such processing.
6. Children's Privacy
ReviewED is not intended for direct use by children. The Service does not permit students to create accounts, log in, or directly submit any personal data. Only adult school staff members are authorised to access and use the Service.
However, the Service may process Student Data — information about students from Grade 1 through Grade 12 — that is uploaded by Authorised Users as part of the School's evaluation evidence gathering and school improvement activities. This Student Data is processed solely on the School's documented instructions and for the limited purpose of supporting the School's evaluation and improvement planning.
COPPA (United States): For US-based schools, ReviewED serves as a "school official" as defined under FERPA. The School — not ReviewED — is responsible for obtaining any required parental consent for the collection and use of Student Data through the Service. ReviewED does not knowingly collect personal information directly from children under 13.
GDPR (European Economic Area & UK): ReviewED does not offer the Service directly to children below the applicable age of consent in the relevant Member State and processes Student Data only on the School's documented instructions.
Philippine Data Privacy Act (RA 10173): ReviewED processes Student Data only on the documented instructions of the School as Data Controller, in compliance with RA 10173 and its Implementing Rules and Regulations.
7. Data Sharing
ReviewED does not sell, rent, or trade School Data or Student Data to any third party for any purpose, including marketing or advertising. Data may be shared only in the following limited circumstances:
- Sub-Processors: ReviewED engages sub-processors (hosting, payment processing, transactional email) to support the delivery of the Service. Sub-processors are listed in our Data Agreement and are bound by data protection obligations no less stringent than those in this Privacy Policy.
- Legal/Law Enforcement: ReviewED may disclose Personal Data if required to do so by applicable law, regulation, or court order, or to protect the rights, property, or safety of ReviewED, its users, or the public. Where legally permissible, ReviewED will provide the School with prior notice of such disclosure.
- Business Transfers: In the event of a merger, acquisition, or sale of substantially all of ReviewED's assets, School Data may be transferred as part of that transaction, subject to the acquirer's agreement to honour the commitments in this Privacy Policy.
8. Cookies & Tracking Technologies
ReviewED uses essential cookies and similar technologies necessary to operate the Service, including session management and authentication cookies. We do not use cookies for targeted advertising or behavioural tracking on pages that display or process Student Data.
You may configure your browser to refuse cookies, but doing so may affect the functionality of the Service. For more information about how we use cookies, please contact us via the Contact Us page.
9. Data Retention
ReviewED retains School Data and Personal Data for as long as the School's subscription is active. Upon termination of the subscription, data is retained for thirty (30) days to allow the School to export its data. After this period, ReviewED will securely and irreversibly delete all School Data and Personal Data, except where retention is required by applicable law.
Billing records and activity logs may be retained for the period required by applicable law (typically five to seven years), after which they are securely deleted.
10. International Data Transfers
ReviewED's servers and sub-processors may be located in countries other than the School's country of operation. Where Personal Data is transferred outside the School's country, ReviewED will ensure that such transfers are subject to appropriate safeguards under Applicable Data Protection Law, including Standard Contractual Clauses (SCCs) where required by GDPR or equivalent frameworks.
11. Your Rights
Depending on your jurisdiction, you (or your School on your behalf) may have the following rights with respect to your Personal Data:
- Right of Access: You may request a copy of the Personal Data we hold about you.
- Right to Rectification: You may request that we correct or update inaccurate or incomplete Personal Data.
- Right to Erasure: You may request that we delete your Personal Data, subject to legal retention obligations.
- Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances.
- Right to Data Portability: You may request that we provide your Personal Data in a portable, machine-readable format.
- Right to Object: You may object to processing based on legitimate interests.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please visit our Contact Us page. We will respond to your request within thirty (30) days (or within the timeframe required by applicable law).
12. Security
ReviewED implements appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. These measures are described in detail in our Data Processing Agreement.
While we take reasonable steps to protect your information, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately via the Contact Us page.
13. Changes to This Policy
ReviewED may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes via email or in-Service notification at least thirty (30) days before the changes take effect. Continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.
14. Governing Law
This Privacy Policy is governed by the laws of the Republic of the Philippines, and in particular the Philippine Data Privacy Act of 2012 (RA 10173). For schools in other jurisdictions, applicable local data protection laws shall also apply to the extent required.
15. Contact
For questions, notices, or concerns regarding this Privacy Policy, please contact us through:
- The Contact Us page on the ReviewED website; or
- LinkedIn Page: ReviewED