Lightspeed Systems® is Your Trusted Partner Lightspeed Trust

COPPA applies to the online collection of personal information by persons or entities under U.S. jurisdiction about children under 13 years of age. Parental consent is required for the collection or use of any personal information of the users.

• Lightspeed Systems complies with the Children’s Online Privacy Protection Act (COPPA), to ensure the online safety of children. Student accounts are provided only through a verified educator, school, or educational organization. Educators agree to obtain parental permission before issuing accounts to students. Please read Lightspeed’s COPPA Notice here.

We meet the following COPPA guidelines listed below and agree to:

• NOT collect online contact information without the consent of either a parent or a qualified educator or educational institution.
• NOT collect personally identifiable offline contact information.
• NOT distribute to third parties any personally identifiable information without prior parental consent.
• NOT entice by the prospect of a special game, prize, or other activity or to divulge more information than is needed to participate in the activity.
• NOT use or disclose student information for behavioral targeting of advertisements to students.
• NOT build a personal profile of a student other than for supporting authorized educational/school purposes.

Education Law § 2-d went into effect in April 2014. The focus of the statute was to foster privacy and security of personally identifiable information (PII) of students and certain PII related to classroom teachers and principals.Lightspeed Systems complies with the NY ED Law 2-D and the Parents Bill of Rights, which requires the following:

• A student’s personally identifiable information (PII) cannot be sold or released for any commercial purpose;
• The right to inspect and review the complete contents of the student’s education record stored or maintained by an educational agency;
• Safeguards associated with industry standards and best practices including but not limited to encryption, firewalls and password protection must be in place when student PII is stored or transferred;
• To be notified in accordance with applicable laws and regulations if a breach or unauthorized release of PII occurs;
• Parents have the right to have complaints about possible breaches of student data addressed;
• Educational agency workers that handle PII will receive training on applicable state and federal laws, policies, and safeguards associated with industry standards and best practices that protect PII;
• Educational agency contracts with vendors that receive PII will address statutory and regulatory data privacy and security requirements.

The SDPC is a unique collaboration of schools, districts, regional, territories and state agencies, policy makers, trade organizations and marketplace providers addressing real-world, adaptable, and implementable solutions to growing data privacy concerns.

• The SDPC released the first National Data Privacy Agreement (NDPA) to streamline application contracting and set common expectations between schools/districts and marketplace providers.
• Lightspeed is working with school districts in all the participating States to ensure we have Data Processing Agreements in place.
• School districts who would like to sign the SDPC and NDPA with us are encouraged to email [email protected].

The California Privacy Rights Act (CPRA) amends and expands on the California Consumer Privacy Act (CCPA). CPRA went into effect on Jan 1, 2023. CCPA was amended to protect the personal data of California employees (B2E) and business-to-business (B2B) contacts and requires all organizations collecting California resident data to apply more extensive protections, such as privacy risk assessments, data minimization and retention policies.The CPRA now focuses data rights on b2b relationships and employees – from transparent data disclosure to more vigorous enforcement and higher awareness of privacy risks related to data collection and processing — and accounting for any data tied to California employees, businesses, and residents.

Who does the California Privacy Rights Act protect?
Any individual who is a California resident employee and a service provider/vendor, contractor, consultant, applicant, freelancer, and remote worker can reasonably be identified.

Employee & B2B Data Rights:

• Right to know: Employees, contractors, and service providers have the right to know what data is being collected and managed with the right to access copies of “specific pieces of personal information.”
• Right to access: Similar to consumers, employees will be able to submit a data subject access request (DSAR) to their employer for access to their information, with some exceptions.
• Right to use and disclose: The right to request that a business limit or stop the use and disclosure of sensitive personal information.
• Right to correct: The right to request that the business correct inaccurate information.
• Right to opt-out: The right to opt-out of having personal information sold or shared.
• Right to Leniency: The right to not be retaliated against for exercising any data rights.

Lightspeed Systems has the following procedures in place to ensure CCPA & CPRA compliance:

• Data Subject Access Requests: Data subjects may exercise their rights by emailing our Privacy Team ([email protected])
• Data Mapping: Mapping, inventory and classification of all data
• Data Minimization: We only process data which is adequate, relevant, and limited to what is necessary to the purposes of the data being used.
• Data Retention Policies: We have implemented Data Retention Policies across all our products and processes. Data is not kept for longer than reasonably necessary to fulfill the processing activity
• Privacy Impact Assessments: We conduct risk assessments of all our products and processes, to ensure privacy and security by design.