Privacy Policy

Applicable framework: Law No. 29733 — Personal Data Protection Law (Peru) and its Regulation (D.S. 003-2013-JUS).

Version 2.0 · effective from 2026-06-23

Clase Privada ("we") operates the Campus education platform and its mobile app (the "Service"). This policy describes how personal data is processed within the Service in accordance with Law No. 29733.

1. Data Bank Owner and Processor

Law No. 29733 distinguishes two roles. Campus assigns them as follows:

Data bank owner: the school. Each educational institution is the owner of its community's data bank (students, parents, teachers, staff). It decides the purpose and content of processing and is responsible toward its data subjects.

Data processor: Clase Privada / Campus. Clase Privada processes data on behalf of and under the instructions of the school, solely to provide the Service. We do not use the data for our own purposes. The relationship is formalized in a Data Processing Agreement (DPA) with each school.

2. Data we process

2.1 Provided by the school

Names of users (teachers, students, parents, administrators).
Institutional and personal emails; national ID (DNI) when the school uploads it.
Roles and positions within the institution.
Academic information: grades, attendance, pedagogical observations, reports.

2.2 Collected automatically

IP address, browser/device type, and access date/time (audit log).
Pages visited within the platform (internal usage analytics).
Push notification tokens (FCM) on mobile devices.

3. Purpose and legal basis

Data is processed exclusively to:

Provide the school management service contracted by the school.
Generate academic reports (report cards, consolidated views, reports) and institutional communications.
Send notifications about relevant academic events.
Maintain the platform's security, integrity, and performance.

Legal basis: processing is grounded in the contractual relationship between the school (owner) and the family/educational community, and in the consent of the parent/guardian for minors' data (see §7). We do not sell, rent, or share personal data with third parties for advertising purposes.

4. Data subject ARCO rights

Anyone whose data is processed in Campus has the rights of Access, Rectification, Cancellation, and Opposition (ARCO), plus information and portability, under Law No. 29733:

Access — know what data is processed and obtain a copy.
Rectification — correct inaccurate or outdated data.
Cancellation — request deletion when no longer necessary or consent is revoked.
Opposition — object to processing on legitimate grounds.

Formal channel and deadlines: requests are addressed to the school (owner) or to our privacy channel privacidad@claseprivada.com. We handle access within 20 business days and rectification, cancellation, and opposition within 10 business days of receipt, per the Regulation of Law No. 29733. If our response is unsatisfactory, you may turn to the National Authority for the Protection of Personal Data (ANPD).

5. National Registry of Personal Data Protection (RNPDP)

Personal data banks managed through Campus are declared before the National Registry of Personal Data Protection (RNPDP) of the ANPD. The school, as data bank owner, is responsible for its registration; Campus, as processor, provides the data inventory and technical assistance for the procedure.

6. Storage and security

Connections encrypted in transit (TLS/HTTPS with HSTS).
Each school runs on its own isolated database (multi-tenant architecture).
Passwords hashed with bcrypt, optional 2FA, and lockout on failed attempts.
Role-based access with least-privilege principle and audit logging.
Automatic daily backups. Controlled deletion (soft-delete) and scheduled purge.

More detail in our Trust Center — Security & Compliance.

7. Minors' data

Campus processes data of underage students. Protecting minors is the highest bar of the Peruvian framework (Law No. 29733 and the Children and Adolescents Code). Therefore:

The legal basis to process a minor's data is the consent of the parent or legal guardian, managed by the school.
We apply minimization: only data necessary for educational management is collected; no excessive information is requested.
Photos and videos of minors require specific parent/guardian authorization before use.
We do not target advertising at minors nor build commercial profiles from their data.

8. Sub-processors

To provide the Service we rely on the following providers who process data on our behalf. Each is bound by equivalent confidentiality and security obligations (back-to-back agreements):

Provider	Purpose	Country	Policy
Hostinger International Ltd.	Server (VPS) hosting and database storage.	Lithuania (EU) / USA	view
Google Firebase Cloud Messaging (FCM)	Delivery of push notifications to the mobile app.	USA	view
MercadoPago (Mercado Libre)	Tuition and subscription payment processing (Checkout Pro). Only when the school enables the gateway.	Argentina / Brazil	view
SMTP email provider (Google Workspace by default)	Sending transactional email (credentials, report cards, notices). Each school may configure its own SMTP server.	USA (or as configured by the school)	view
Groq, Inc. · AI	AI-assisted generation of comments and reports (pseudonymized data).	USA	view
Cerebras Systems, Inc. · AI	AI-assisted generation of comments and reports (pseudonymized data).	USA	view
Mistral AI · AI	AI-assisted generation of comments and reports (pseudonymized data).	France (EU)	view
OpenAI, L.L.C. · AI	AI-assisted generation of comments and reports (pseudonymized data).	USA	view
OpenRouter, Inc. · AI	Routing to AI models (pseudonymized data).	USA	view
Cohere Inc. · AI	AI-assisted generation of comments and reports (pseudonymized data).	Canada	view
Z.ai (Zhipu AI) · AI	AI-assisted generation of comments and reports (pseudonymized data).	China	view

9. AI-assisted processing

Some features (report comments, conclusions) use AI models from the providers marked AI in the table above, located outside Peru. Therefore:

Prior pseudonymization: before any text is sent to the AI, names are replaced with pseudonyms and DNI/phone-like numbers are stripped. The AI provider does not receive the student's direct identity.
Human review: AI-generated comments and predictions are an aid; a teacher reviews and approves them before use. There are no fully automated decisions about the student.
Per-school opt-out: each school can fully disable sending data to the AI; the Service keeps working with its non-AI alternatives.

10. International transfers

Some sub-processors (AI providers, Firebase, email and, where applicable, hosting) process data outside Peru. These transfers are carried out with adequate confidentiality and security safeguards and are declared as a cross-border flow before the ANPD under Law No. 29733.

11. Data retention

Academic data is kept for the duration of the contract with the school. Upon termination, the school may export all its information; after the grace period, data is deleted from the servers and backups are purged per the current retention policy.

12. Data Protection Officer (DPO) and contact

Clase Privada has designated a Data Protection Officer (DPO) as the point of contact for any privacy matter or exercise of ARCO rights. Formal channel:

Privacy / DPO: privacidad@claseprivada.com
Web: claseprivada.com

13. Changes to this policy

We may update this policy. Each version is identified by a number (Version 2.0) and an effective date. Substantial changes are communicated to schools and, where applicable, a new consent is requested.

← Back to Campus