Thank you for choosing StepsWeb ("we," "us," or "our"). This comprehensive Privacy Policy is designed to provide a detailed understanding of how we collect, use, disclose, and protect your personal information. By accessing or using our services, you agree to the terms outlined in this policy.
Compliance with Australian and New Zealand Privacy Legislation
StepsWeb complies with the most recent versions of the Privacy Act 1988 (Australia) and the Privacy Act 2020 (New Zealand). Our collection, storage, and use of personal information are managed in accordance with these Acts to ensure transparency, security, and lawful processing of all personal data.
Compliance with UK and EU GDPR
StepsWeb (The Learning Staircase Ltd) is the data controller (the organisation that determines the purposes and means of processing your personal information) for the services we provide. This Privacy Policy applies to all users, including those in the European Union (EU) and the United Kingdom (UK). We adhere to the requirements of the EU and UK General Data Protection Regulation (GDPR) to protect the rights and data of users in these regions.
We store all student data on AWS in Sydney, NSW, Australia. All student data is encrypted. There are more details below.
We have appointed a Data Protection Officer (DPO), Mike Lugg (mike@stepsweb.com), who is responsible for overseeing privacy matters. You can contact him if you have any questions or concerns about how we handle your data.
For this document, an “Educator” is defined as a parent and/or teacher user on a StepsWeb account.
We may collect and hold various types of personal information, depending on your relationship with us. You may fit under multiple categories.
Contact information about StepsWeb Educators will be visible to other Educators who share the same school account.
Purpose of holding that information:
Legal basis
To perform our contract with you (we need this information to provide the StepsWeb service and manage your account).
Origin of information:
Supplied by you when you create your account on StepsWeb.
Purpose:
Helps us understand which parts of the product are used and how. It helps us make decisions such as the types and ages of devices we need to support, or which features are important to customers so we can plan future updates.
Legal basis
Legitimate interests (we use this data to improve our services and user experience, ensuring this does not override your rights).
Origin:
Automatically collected as you use our services.
Purpose:
Legal basis
To perform our contract and comply with legal obligations (we need these details to set up and bill your account, and to meet record-keeping requirements).
Origin:
Supplied by you when you create a School account on StepsWeb.
Purpose:
Record of purchases.
Legal basis
To perform our contract and comply with legal obligations (we use this information to process payments and maintain proper financial records).
Origin:
Collected during purchases. Note that credit card details are never stored.
Purpose:
StepsWeb provides a one-way messaging feature that allows Educators to send brief messages of encouragement or guidance to students associated with their account. Students cannot reply to these messages, and the feature cannot be used for communication between students.
Legal basis
To perform our contract with the school or account owner. The messaging feature is part of the StepsWeb service and allows teachers to provide students with encouragement and learning-related guidance.
Information retained:
We retain a record of messages sent through this feature, including the message content, sender, recipient and the date and time sent. Messages are accessible only to authorised users and StepsWeb personnel where required for support, security or compliance purposes.
Origin:
Supplied by an Educator using the StepsWeb messaging feature.
Disclosure:
Message records may be provided to the school or account owner upon an authorised request. They may also be disclosed to government agencies, regulators or law enforcement authorities where required or authorised by law. StepsWeb does not use message content for advertising or marketing purposes.
A student’s personal data is supplied by an Educator on the same account. Pseudonyms can be used if desired.
Information about StepsWeb students is available to Educators on the same account.
Purpose:
Shown to the user when they log in and is always visible in the title bar. This allows teachers to easily confirm that the student is logged into their own account. It is also visible to Educators when viewing learning data.
Legal basis
Consent and contractual necessity (a teacher or parent provides this data and consents on the student’s behalf, and it is needed to deliver the student’s learning experience).
Origin:
Supplied by Educator.
Purpose:
Legal basis
Consent (this is optional information provided for convenience, and we only use it if you choose to give it)
Origin:
Supplied by Educator.
Purpose:
Legal basis
Consent (this date of birth info is optional and only used to tailor the service if provided).
Origin:
Supplied by Educator.
Purpose:
Helps us understand which parts of the product are used and how. It helps us make decisions such as the types and ages of devices we need to support, or which features are important to customers so we can plan future updates.
Legal basis
Legitimate interests (we improve our educational services by understanding how students use them, without compromising student privacy).
Origin:
Automatically collected as you use our services.
Purpose:
Legal basis
To perform our contract (tracking learning progress is necessary to provide the educational service).
Origin:
Collected as students complete learning activities within StepsWeb.
Purpose:
Legal basis
To perform our contract (we calculate this to personalise the learning experience as part of the service).
Origin:
Determined by the student’s usage within StepsWeb, and/or via the Placement Test.
We do not disclose visitor information to anyone outside our organisation.
Purpose:
Legal basis
Consent (you provide this information so we can respond and personalise your experience).
Origin:
Form submissions.
Purpose:
Origin:
Form submissions.
Purpose:
In addition to above, if you contact us directly then we may collect:
Purpose:
Used to manage our interactions with you.
Legal basis
Consent (you provide this information so we can respond and personalise your experience).
Origin:
Supplied by you when contacting us.
Purpose:
Provides context for future contact. For example, negotiation of sales that take place between different staff members.
Origin:
Supplied by you when contacting us.
When you contact us, we may collect:
- Correspondence
- Contact information
Student accounts are typically created by teachers, school administrators or parents. By creating student accounts on StepsWeb, teachers/parents provide consent and authorisation for StepsWeb to store and process personal data about those children.
StepsWeb Educator Personal Information
Educators may request access to and correction of their own personal information. Please make any request via email, using the same address that you use for your StepsWeb account. Requests can be made to info@stepsweb.com.
StepsWeb Student Personal Information
Student data may be requested by Educators on the same account. It may also be requested by associated professions, such as specialist teachers supporting that account. However, in those cases, we require verification from the account owner that this person has the account owner’s permission to access the student’s data.
If, as an Educator, you want to make a request for information from us, please make the request via email, using the same address that you use for your StepsWeb account.
We recommend making requests via the Educator. Verified parents/guardians may exercise rights on behalf of their child, and students may exercise their own rights where permitted by law. We may notify the relevant account owner (e.g., the school) of such requests for security and coordination, but we will not require the account owner’s prior permission to process lawful requests. We will authenticate the requester, coordinate with the school or account owner as appropriate, and respond within applicable statutory timelines.
Non-StepsWeb Personal Information
Upon verifying your identity, you may request access and correction of your personal information via email to info@stepsweb.com.
We are committed to protecting your personal information and only retaining it for as long as necessary.
For users located in New South Wales, Australia, personal information will be permanently deleted after 6 months, in accordance with local regulatory requirements.
Backups and archival copies may be retained for a limited period beyond the deletion date, solely for system integrity, audit, or legal compliance purposes.
Where required by regulation or upon request, StepsWeb will issue a certificate confirming secure and permanent deletion of data.
We do not sell student or user personal information, and do not release personal information collected or received to any unrelated third parties for promotional purposes. We do not allow any student data to be sent to any advertisers, and we do not show any advertisments within StepsWeb to students. We may, however, share aggregated product usage data with unrelated third parties, and share personal information only as described below:
Service Providers
We may share your information with our service providers—that is, organizations providing services to support StepsWeb functions, such as our hosting services provider, mail and email processing providers, payment processing providers, and research and support providers. All such service providers are bound by contract to refrain from using the personal information we collect from you for any purpose other than providing the specified services to StepsWeb. These service providers act as our data processors (they process personal data only on our behalf and under our instructions). We ensure they uphold the same privacy standards and security measures that we do.
In our commitment to privacy and tailored experiences, HubSpot tracking is specifically employed for teacher interactions, not students, ensuring a focused educational environment free from monitoring. For site and login analytics, Google Analytics is used, excluding the app post-login to safeguard student privacy. Additionally, Datadog supports our system's reliability and performance, without involving personal data, maintaining a secure and efficient service for all users.
Distribution Partners
If we have a distribution partnership with a company for your region, then we may disclose information to them for sales and support purposes. We ensure they uphold the same privacy standards and security measures that we do.
The following sub-processors are used to host or store student and school data within StepsWeb.
| Sub-Processor | Services Provided | Types of Data Processed | Processing Location | Compliance & Security |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, hosting, data storage and computing services |
Student, educator and school account information, learning activity records and account settings |
Sydney, Australia | Privacy Policy, Data Protection & Compliance ISO 27001, ISO 27017, ISO 27701 and ISO 27018. Data stores are encrypted. |
| MongoDB | Managed database services through MongoDB Atlas |
Student, educator and school account information, learning activity records and account settings This includes: |
Sydney, Australia, hosted on AWS | Privacy Policy, Security & Compliance Data is encrypted both in transit and at rest. |
The following sub-processors support the operation of StepsWeb but do not store student personal information or learning data.
| Sub-Processor | Services Provided | Types of Data Processed | Processing Location | Compliance & Security |
|---|---|---|---|---|
| Datadog | Infrastructure and application monitoring, performance metrics and event monitoring | System logs, client IP, usernames, performance metrics and event data. Personal information is obscured from logs. | United States | Privacy Policy ISO 27701 and ISO 27001. Data is stored encrypted. |
| Google Analytics | Website and login page analytics | Website and login page usage data. Students are not tracked inside the StepsWeb application and no personally identifiable information is stored Data is collected locally and anonymised before potentially being processed and stored internationally |
Global |
Privacy Policy, Analytics Privacy Controls |
| HubSpot | CRM, website services and conversion tracking |
Customer interaction records and conversion tracking data. Contains organisation names, billing addresses, educators, but no student data is stored. This includes: |
Australia, backup in other data centre, hosted on AWS | Privacy Policy, Security HubSpot tracking is not loaded for students. |
| Xero | Accounting and invoicing services |
Customer and organisation contact information, billing details, invoices, transaction records and payment status information. This includes: |
New Zealand, Australia, and United Kingdom | Privacy Policy (NZ), Privacy Policy (AU), Privacy Policy (UK), Security Safeguards are in place for international data transfers. |
International Data Transfers
Your personal data may be transferred to and stored in countries outside of your own (including outside the EU or UK). For example, our main servers are in Australia, and some of our service providers are based in the United States. When we transfer data internationally, we ensure it remains protected to the standards of EU/UK law. This means that if we send your data overseas, we use safeguards such as Standard Contractual Clauses (SCCs) (standard legal agreements to protect your data) or rely on countries deemed to have adequate data protection laws (for instance, New Zealand is recognised for having privacy laws that protect personal data similarly to the EU). These measures ensure your data is safeguarded wherever it is processed. All student data is kept within Australia.
Under data protection laws like the GDPR, you have several important rights regarding your personal information. These include:
To exercise any of these rights, please contact us at info@stepsweb.com (or reach out to our DPO at the email above). We will be happy to help and will respond within one month, or sooner if possible.
We maintain appropriate technical and organisational security measures to protect personal information against unauthorized access, use, alteration, or disclosure. These include, at a minimum:
We review these controls at least annually and update them as appropriate.
If you wish to make a complaint about any privacy issues to do with StepsWeb or, if you are unhappy about anything contained in this Privacy Policy, you can file a complaint by contacting us at info@stepsweb.com. We will promptly investigate and address your concerns. If you are in the EU or UK and are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority.
We reserve the right to update this Privacy Policy to reflect changes in our practices. We will notify users of any material changes through the appropriate channels.
For any questions or concerns regarding this Privacy Policy, please contact us at info@stepsweb.com.
For legal purposes, the governing law of this policy aligns with the jurisdiction described in our Terms and Conditions
The best way to contact us is by email at one of the following email addresses:
info@stepsweb.com
technical@stepsweb.com
The Learning Staircase Ltd
PO Box 582
Rangiora 7440
New Zealand
