Privacy Policy

Draft for approval. This text was prepared for review and approval by FCA and has not yet been published.

1. About this policy

This policy explains how Fredericton Christian Academy ("FCA"), Fredericton, New Brunswick, Canada, handles personal information in its enrolment system and partner portal. FCA is responsible for the personal data that it processes to admit students and to administer their enrolment.

Educational partners that send students to FCA are independent from FCA. They collect data from families for their own purposes, under the laws that apply to them, and are responsible for that data. This policy applies to students, parents and legal guardians, representatives of partners, FCA staff, school users and host families. It is written in line with the Canadian PIPEDA (see the PIPEDA notice) and, for residents of Brazil, the LGPD (see the LGPD notice).

2. Data we collect

We collect the personal data needed for the enrolment process:

• Student and guardian identification (full name, date of birth, gender, nationality, ID document and number, passport number and expiry, immigration profile, and the guardians' profession and employer)
• Contact details, address and an emergency contact
• Documents you upload (for example a copy of the passport, identity documents, school records and the vaccination record)
• Health and well-being information given in the forms (medical conditions, allergies, medication, dietary needs)
• Homestay profile, when the program includes homestay (interests, habits, religion and cultural or dietary preferences)
• Host family information (household details, address and contact), when a student is placed with a host family
• Travel information (flight details, including details read from uploaded tickets)
• Payment information (payment declarations, proofs of payment, amounts, and invoices issued in the name of the guardian)
• Account data of partner representatives and FCA staff (name, work e-mail, organization, country, role and language)
• Technical records (date and time of acceptance or submission, language, an approximate network address and the browser type)

We do not collect photographs of students in the enrolment system.

3. Where the data comes from

The data comes from the family (through the forms and its personal link), from the educational partner acting for the family, from FCA staff and school users who record the progress of the enrolment, and from the system itself (for example the technical records and the details read from uploaded documents).

4. How we use your data and why

• Process and manage the enrolment at FCA
• Communicate with parents, the student, the school and educational partners, including e-mails about the process: access to the system, enrolment status, documents, payments, flights, the personal links sent to families, and notices when a legal document changes
• Issue required documents (such as the Letter of Acceptance and custodianship documents)
• Comply with legal obligations, including Canadian immigration, education and accounting rules, and keep a record of acceptances of our legal documents
• Match the student with a host family, when applicable
• Keep the system secure, prevent misuse and keep an audit trail of important actions

We rely on the consent of the parents or legal guardians (and of the student where appropriate), on what is necessary to carry out the enrolment that the family has requested, on legal obligations, and on our legitimate interest in keeping the system secure. You can withdraw a consent at any time, but this may prevent us from continuing the enrolment. We do not use personal data for advertising, and we do not sell it.

5. Automatic reading of documents

Some uploaded documents (flight tickets and proofs of payment) are read automatically, on our own server, to suggest dates and amounts. The suggestion is always checked by a person; no decision about you is made automatically.

6. Who receives your data

• Fredericton Christian Academy (Canada): enrolment processing, by FCA staff and school users, according to their role
• The authorized educational partner: follow-up of the enrolment
• The selected host family, when the program includes homestay
• Government authorities, when required by law (for example immigration)

To run the system we also use service providers that handle data on our behalf, only for that purpose:

• Brevo: sends our e-mails and may keep contact details (name, e-mail, phone, organization and country) of business contacts and partners
• Supabase: database and storage of the uploaded files, on Amazon Web Services infrastructure
• The server where the application runs, which also reads uploaded tickets and proofs of payment automatically; these files are not sent to any third-party reading or artificial intelligence service
• ViaCEP and Zippopotam: address lookup; they receive only the postal code that is typed in

7. Third-party content on our pages

Some pages load fonts (Google Fonts), videos (YouTube) and flag images (flagcdn) directly from those services, which can see your IP address and browser type.

8. International transfers and where data is stored

The database and the uploaded files are stored on cloud infrastructure of Supabase, which runs on Amazon Web Services, in the sa-east-1 region, in São Paulo, Brazil. Data about a student is therefore collected in the student's country, stored in Brazil, and accessed by FCA staff in Canada and by authorized partners in their own countries. Data that crosses borders is subject to the laws of the countries involved, and courts or authorities there may be able to access it under those laws.

The server that runs the application handles data only to operate the system, with the same safeguards described in this policy. Our safeguards for transfers are: access restricted by profile; short-lived signed links to files; automatic reading of documents on our own server; no use of third-party artificial intelligence services; and the obligations that partners accept in the Terms of Service.

9. How we protect your data

We protect data with encryption in transit (HTTPS/TLS), access by role (administrators, partners, schools and families), private file storage with short-lived access links, and personal links for families that expire after 14 days and are stored only in a protected form. We keep an audit trail of important actions. No system is completely secure. If a breach of security safeguards creates a real risk of significant harm, we notify the people affected and the authorities as the law requires, and we keep a record of it.

10. Retention, recycle bin and anonymization

We keep personal data only for as long as it is needed to administer the enrolment and to meet legal, accounting and security obligations. As a general rule:

• enrolment, payment, invoicing, acceptance and audit records are kept for up to seven (7) years after the end of the school year in which the student's last program ends;
• identity, health and homestay documents uploaded by families are kept for up to two (2) years after the end of the program, unless a legal obligation, an immigration or custodianship matter or a dispute requires a longer period.

After these periods the data is anonymized or deleted. This is done by FCA administrators, not automatically by the system. When FCA staff delete an enrolment it goes to a recycle bin, where it can be restored for 30 days; after that an administrator anonymizes it: the identifying data in the record is replaced, and the record itself is not erased. Uploaded files stay in private storage until FCA removes them. You can ask for your data to be deleted earlier; we will do it unless a legal obligation requires us to keep it, and in that case we will explain why.

11. Cookies and browser storage

We use only the cookies and browser storage that are essential: session cookies to keep you signed in, and temporary storage in your browser, for example to keep an unsent form draft. The language you choose is remembered in your profile when you are signed in. We do not use advertising or analytics cookies, so there is no cookie banner.

12. Students under 18 and health information

Most students are minors. Information about them is provided by their parents or legal guardians, or by the educational partner on their behalf, with the guardians' consent. Health information is collected to support the school, the homestay and the student's well-being during the program, and it is accessed only according to the role of each profile. We do not use information about minors for advertising.

13. Your rights and how to exercise them

• Access the data we hold about you, and know with whom it is shared
• Correct incomplete or inaccurate data
• Request deletion or anonymization of your data, where legally permitted
• Withdraw consent for processing that depends on it
• Receive a copy of your data in a common format
• Challenge how we handle your data

To exercise any of these rights, write to the Privacy Contact: [email protected]. For a student who is a minor, the request is made by a parent or legal guardian. We may ask you to confirm your identity. We reply within 30 days of receiving the request; if we need more time, as the law allows, we will tell you why. For residents of Brazil, the LGPD sets shorter terms, described in the LGPD notice. Requests are handled by people, free of charge in general, and we may refuse part of a request only for reasons allowed by law, which we will explain. Families can also correct their details at any time through their personal link. If your request concerns data that a partner holds for its own purposes, contact the partner.

14. Complaints

Please write to us first so that we can try to resolve the matter. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), to the Brazilian National Data Protection Authority (ANPD) if you live in Brazil, or to the data protection authority of your own country.

15. Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page. When a change is relevant, partners are asked to accept the new version the next time they sign in, and the new version is published on this page.

16. Contact

For privacy questions and requests: Privacy Contact: [email protected]. For general questions and support: [email protected] or [email protected] (WhatsApp +55 19 99964-9625).