OFALycée is an accredited online school serving students aged approximately 5 to 18 years old. Protecting the privacy, safety, and well-being of our students and families is fundamental to our mission. This Privacy Policy explains how we collect, use, store, and protect personal data when you use:

www.ofalycee.org (the “Website”)
Our digital services, including:
- student and parent portals
- scheduling system
- Student Information System (SIS)
- learning platforms (including Canvas LMS and Zoom)
- OFA Academy and related services (collectively, the “Services”)

1. Who We Are

OFALycée is an accredited online school providing bilingual and international educational programs.

Legal Entity: OFALYCEE, Inc.
Address: 27 Berkshire Dr, Massachusetts, United States
Contact: contact@ofalycee.org — for general questions, data-protection or safeguarding matters (mention “Privacy” or “Safeguarding” in your subject line for faster routing)

For the purposes of data protection laws, OFALycée acts as a data controller.

2. Applicable Laws & Compliance Framework

Because we serve minors across multiple jurisdictions, we design our practices to meet — and where possible exceed — the following frameworks:

COPPA — U.S. Children’s Online Privacy Protection Act (children under 13)
FERPA — U.S. Family Educational Rights and Privacy Act (student education records)
CIPA — U.S. Children’s Internet Protection Act principles (safe online environments)
GDPR & GDPR-K — EU General Data Protection Regulation, including reinforced protections for minors
CCPA / CPRA — California Consumer Privacy Act and amendments
Massachusetts state law (201 CMR 17.00 — Standards for the Protection of Personal Information of Residents of the Commonwealth)

3. What Data We Collect

a. Identity & Contact Information

First and last name (student, parent or guardian)
Email address and phone number
Postal address (country, time zone)

b. Student & Educational Data

Grade level and academic records
Course enrollment and scheduling data
Attendance and participation
Evaluations, transcripts, and progress reports
Communications between teachers, students and families

c. Account Information

Login credentials (stored hashed and salted)
Account preferences and language settings

d. Technical & Usage Data

IP address and approximate location
Browser type and device information
Pages visited and basic interaction data (analytics, only after cookie consent)

e. Payment Information

Billing details, processed exclusively through secure third-party payment providers (we do not store card numbers on our servers)

f. Data We Do Not Knowingly Collect

We do not knowingly collect sensitive categories such as racial or ethnic origin, religious beliefs, political opinions, biometric data, or precise geolocation, unless strictly necessary for an educational accommodation and only with explicit parental consent.

4. How We Use Your Data

We use personal data to:

Provide and manage educational services
Administer student enrollment, scheduling and class assignments
Maintain academic records (SIS)
Communicate with students and families through official channels
Ensure the safety and integrity of online classrooms
Improve our Services (in aggregated or pseudonymised form)
Comply with legal obligations

5. Children’s Privacy (Ages 5–18)

OFALycée serves students of all school ages, including children under 13. We apply the following principles to every minor:

Verifiable parental consent is required before we collect or process the personal data of any child under 13 (COPPA) and, where required, under 16 (GDPR-K).
Parents and legal guardians can, at any time:
- review the information held about their child;
- request correction or deletion;
- refuse further collection;
- request a copy of the data in a portable format.
Students are never asked to provide more information than what is strictly necessary for their education.
Accounts created for minors are linked to a parent or guardian email for oversight.

6. Safeguarding & Child Protection

Beyond data privacy, we apply additional safeguards because our users include minors:

Code of Conduct for staff: all teachers and staff interacting with students must respect a written code of conduct prohibiting any inappropriate, harassing, discriminatory or sexualised content, language or behaviour.
Communication channels: staff communicate with students primarily through official OFALycée channels (school email, Canvas, scheduled Zoom classes). For high-school students, additional channels such as WhatsApp may be used for class-related communication (e.g. group reminders, homework clarifications), under the following safeguards:
- communications stay strictly related to school topics;
- group conversations are preferred over private one-to-one messages whenever possible;
- professional conduct and the Code of Conduct described above apply to every message;
- parents/guardians may, on request, be informed of the communication channels used and the topics covered;
- students and families may opt out and request communication exclusively through official channels at any time.
Personal channels: staff do not use personal social-media accounts to engage with students.
Anti-bullying & anti-harassment: any form of bullying, cyberbullying or harassment between students or directed at staff is strictly prohibited and may result in disciplinary action up to and including removal from the program.
Reporting concerns: any student, parent or staff member may report a safeguarding concern confidentially to contact@ofalycee.org. Reports are taken seriously and investigated promptly.
Mandatory reporting: OFALycée staff comply with applicable mandatory reporting obligations under Massachusetts law (M.G.L. c. 119, § 51A) and equivalent statutes where they reside, when there is reasonable cause to believe a child has been abused or neglected.

7. Photo, Video & Class Recording

Live classes are not systematically recorded.
On-demand recordings may be made through Zoom (e.g. for a student who missed a class for medical reasons) and shared inside the relevant Canvas course. These recordings are accessible only to enrolled students and authorised staff of that course.
Recordings are retained for the duration reasonably needed for academic use and then deleted.
We do not publish photos, videos or recordings of identifiable students on the public website or social media without separate, written parental consent for that specific use.
Marketing assets featuring students or alumni are only used after explicit consent, which can be withdrawn at any time.

8. Artificial Intelligence & Student Data

OFALycée does not deploy third-party generative AI tools (such as ChatGPT, Gemini, Claude, etc.) directly with students as part of its instruction.
Student personal data, coursework, assessments, recordings and classroom content are never used to train external AI models by OFALycée.
Where any internal tooling assists staff with administrative tasks (e.g. drafting communications), no identifying student data is submitted to such tools.
If our use of AI evolves, this Policy will be updated and, where required, parental consent will be obtained.

9. What We Do Not Do

For full transparency, we want families to know what we explicitly will not do:

We do not sell, rent or trade personal data.
We do not display third-party advertising on our Services and do not permit advertising targeted at minors.
We do not use student data to build commercial profiles or for behavioural marketing.
We do not share student data with data brokers.
We do not install advertising trackers, retargeting pixels or social-media tracking pixels on pages used by enrolled students.
We do not use student data to train external AI models.

10. Legal Basis for Processing (GDPR)

For users in the European Union, we process personal data based on:

Consent (including verifiable parental consent for minors)
Performance of an educational contract
Legal obligations (e.g. record-keeping, mandatory reporting)
Legitimate interests (e.g. ensuring the safety and integrity of our online classrooms), balanced against the rights and freedoms of data subjects.

11. Cookies & Tracking Technologies

Cookies and similar technologies are used to:

Ensure proper functioning of the Website
Remember user preferences (e.g. language)
Measure aggregated usage (only when analytics consent is granted)

You can control cookie settings through the in-site cookie banner or your browser. See our Cookie Policy for details.

12. Third-Party Services

We rely on a small number of trusted providers, each bound by appropriate confidentiality and data-protection obligations (Data Processing Agreements where applicable):

Canvas LMS — learning management and coursework
Zoom — live online classes and on-demand recordings
HubSpot — admissions communications and CRM
Acuity Scheduling — admission appointment booking
Resend — transactional emails (e.g. recruitment applications)
Google Analytics 4 — aggregated, consent-based website analytics
SiteGround / GoDaddy / Emergent Labs — hosting and infrastructure

These providers process data on our behalf and are required to maintain appropriate safeguards.

13. Data Retention

We retain personal data only as long as necessary for educational, legal or administrative purposes:

Active student records: for the duration of enrollment and continued schooling at OFALycée.
Academic transcripts & diploma records: retained long-term to allow former students to obtain copies for university or employment.
Class recordings (on-demand): deleted at the end of the academic year unless legitimately required for longer.
Marketing & admissions enquiries: deleted or anonymised after a reasonable inactivity period.
Recruitment applications: retained for the duration of the recruitment process and a limited additional period for legal reasons, then deleted.

14. International Data Transfers

Because of the international nature of OFALycée, personal data may be processed in multiple countries, including the United States and the European Union. We rely on appropriate safeguards, including Standard Contractual Clauses where required, to ensure data protection in accordance with applicable laws.

15. Your Rights

Depending on your jurisdiction, you (or a parent/guardian on behalf of a minor) may have the right to:

Access the personal data we hold
Correct inaccurate or outdated data
Request deletion (subject to legal retention obligations)
Restrict or object to certain processing
Withdraw a previously given consent
Receive a copy of the data in a portable format
Lodge a complaint with a competent supervisory authority (e.g. CNIL in France, Massachusetts AG in the U.S.)

To exercise your rights, contact contact@ofalycee.org. We respond within 30 days, or sooner where required by law.

16. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to:

Know what personal data we collect and the purposes for which it is used
Request access, correction, or deletion of your personal data
Opt out of the sale or sharing of personal data (we do not sell or share personal data for cross-context behavioural advertising)
Not be discriminated against for exercising your privacy rights

17. Data Security

We implement technical and organisational measures designed to protect personal data, including:

Encryption in transit: all pages and APIs served over HTTPS / TLS 1.2+
Encryption at rest for sensitive databases hosted with our infrastructure providers
Password hashing using industry-standard algorithms (bcrypt or stronger)
Access controls based on the principle of least privilege — staff only access the data they need to perform their role
Multi-factor authentication on staff accounts where supported by the underlying platform
Restricted-access areas (e.g. Parents Area) protected by dedicated passwords and bot-resistant rate limits
Regular software updates and dependency monitoring on our Website and backend services
Vendor due diligence — we select processors who maintain recognised security certifications (e.g. SOC 2, ISO 27001) where available
Internal logging & monitoring for suspicious activity

No system is completely secure; we continuously improve our defences and review incidents.

18. Data Breach Notification

In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, we will:

Notify the competent supervisory authority within 72 hours where required (GDPR Art. 33)
Notify affected families without undue delay when the breach is likely to result in a high risk to them
Document the breach, its effects and the remediation actions taken

19. Links to Other Websites

Our Services may contain links to third-party websites. We are not responsible for their content or privacy practices. We encourage families to review the privacy policies of any external site before sharing personal information.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect operational, legal or regulatory changes. Updates will be posted on this page with a revised effective date. Material changes affecting children’s data will be communicated to parents through our usual channels.

21. Contact Us

If you have any questions, requests or concerns regarding this Privacy Policy:

OFALycée
OFALYCEE, Inc.
Contact: contact@ofalycee.org — for general, data-protection or safeguarding matters (please mention “Privacy” or “Safeguarding” in your subject line for faster routing)
Website: www.ofalycee.org