Privacy Statement

This privacy notice applies to personal and other information stored and hosted by KAMAR Limited on behalf of schools.

Abstract

KAMAR Limited provides software, called KAMAR, for education providers. KAMAR Limited acts both as an organisation that collects and manages personal information for its own business purposes and as a service provider that stores and processes personal information on behalf of education providers.

Information added to KAMAR by education providers has been collected by them and is held by them, whether it is hosted by the education provider or by KAMAR Limited. We do not use, analyse, or extract information added by education providers without prior consent. Where an education provider has collected and added information into KAMAR, the education provider remains responsible for that information and requests for access or correction should generally be directed to the education provider.

KAMAR Limited does collect some personal information. We hold personal information of staff nominated by their employer to act as administrators in KAMAR. We do not collect any personal information from users who access KAMAR in their capacity as a student, caregiver or teacher, unless that person is also a nominated administrator or the school has opted in to an additional service such as ‘school.kiwi’. This privacy statement applies to personal and other information collected, stored and hosted by KAMAR Limited.


1. Introduction

1.1. We, KAMAR Limited, are committed to safeguarding the privacy of our customers. This notice will explain how we will collect, store and use personal information. Personal Information means information we receive about identifiable individuals.

1.2. Should any breach of privacy occur, we will notify affected persons as appropriate.

1.3. This notice may be updated from time to time. Where possible, we will notify you within ten working days (two weeks) of any changes to this Privacy Statement. The latest version will be available on our website.


2. Collection of Personal Information

2.1. We will not collect personal information unless it is connected with, and is necessary for, a purpose of the operation of the KAMAR software.

2.2. We will collect personal information in the following ways:

  1. From the information provided to us when registering to use our product;
  2. From information provided through using our products and services;
  3. From any authorised third party;
  4. From publicly available information.

2.3. We collect and store the following types of personal information:

  1. Details of administrators nominated by educations providers, including (but not limited to) names, addresses, telephone numbers, and email addresses.
  2. Details of other persons who contact us about KAMAR products, including (but not limited to) names, email addresses, and any other information disclosed in correspondence with us.
  3. Details of persons who opted in to specific services provided by KAMAR such as ‘school.kiwi’, including (but not limited to) names, telephone numbers, email addresses and information sent and received using such services.

2.4. Education providers are responsible for collecting the personal information which they upload to the KAMAR software. We store the following types of personal information on behalf of education providers:

a. Staff, Student and Caregiver details, including (but not limited to) names, addresses, telephone numbers, email addresses, date of birth, ethnicity and iwi affiliation, national student number, education attendance, academic attainment records, medical details, guidance, financial.

2.5. Before the personal information of another individual is disclosed, the individual’s consent must be obtained for the disclosure, use and storage of their information by us.

2.6 Where personal information is necessary to provide a product or service, manage an account, or respond to a request, failure to provide the requested information may mean that we are unable to provide the relevant product or service, respond to the request, or otherwise perform the relevant function.


3. Use of Personal Information

3.1. We may use personal information collected by us in the following ways:

  1. To provide services or products to you;
  2. To verify the accuracy and suitability of, or compliance with, our terms and conditions;
  3. To improve our services to you;
  4. To investigate any complaint;
  5. To conduct research or statistical analysis;
  6. For any other purpose authorised by you.

3.2. We may use personal information collected by education providers in the following ways:

  1. To conduct a final test before deployment of an update of the KAMAR software.
  2. For opt-in services such as ‘school.kiwi’, which function by sending information between the education provider and staff, students or care givers.


4. Disclosure of Personal Information

4.1. Personal information may be disclosed to education providers, authorised users, service providers and contractors supporting our products and services, third parties authorised by you, and government or regulatory authorities where required or permitted by law.


5. Integrations

5.1. KAMAR passes certain information to certain third parties for specific purposes and functions. Information may be collected, handled, processed or stored by them.

5.2 Native integrations that are available through KAMAR are disabled by default and must be enabled by an authorised user in the school. The native integrations available are:

a. WebSMS

Contact: https://websms.co.nz
Data type disclosed: text messages, which could include names, recipient phone numbers and sensitive information.
Purpose/Use: text messages sent using school.kiwi are routed through WebSMS, which are then passed on to the appropriate mobile provider (eg, Spark, OneNZ or 2Degrees).
Counties where data may be processed: New Zealand

b. TxtStream

Contact: https://www.txtstream.co.nz/
Data type disclosed: text messages and/or absence notifications, which could include names, recipient phone numbers and sensitive information.
Purpose/Use: text messages and/or absence notifications are routed through TxtStream, which are then passed on to the appropriate mobile provider (eg, Spark, OneNZ or 2Degrees).
Counties where data may be processed: New Zealand

c. School-links

Contact: https://www.school-links.co.nz
Data type disclosed: text messages and/or absence notifications, which could include names, recipient phone numbers and sensitive information.
Purpose/Use: text messages and/or absence notifications are routed through School-links, which are then passed on to the appropriate mobile provider (eg, Spark, OneNZ or 2Degrees).
Counties where data may be processed: New Zealand

d. Microsoft Entra ID

Contact: https://www.microsoft.com/en-nz/security/business/identity-access/microsoft-entra-id
Data type disclosed: depends on school configuration, but student data could include personal information (eg, names, gender, phone number, date of birth) and school information (eg, year level, house, tutor group, subjects, core class). Staff data could include personal information (eg, names, gender, phone number) and school information (eg, classification, departments, classes, tutor group).
Purpose/Use: send staff and student information from KAMAR to populate Entra ID via the Microsoft Education and Graph APIs.
Counties where data may be processed: New Zealand / Australia.

e. Athenaeum Library

Contact: https://sumware.co.nz
Data type disclosed: personal information (eg, name, gender, ethnicity, email addresses, address, phone numbers) and school information (eg, year level, tutor group, class).
Purpose/Use: send student and staff information from KAMAR to populate 'borrowers' in Athenaeum.
Counties where data may be processed: New Zealand

f. Xero

Contact: https://www.xero.com/nz
Data type disclosed: payment details, account numbers and account totals.
Purpose/Use: send details of payments recorded in KAMAR to Xero.
Counties where data may be processed: New Zealand

g. Ministry of Education

Contact: https://www.education.govt.nz
Data type disclosed: personal information about students, caregivers and staff, attendance data, responses to student absences, school calendar data, student entries and results (NCEA, Phonics, OTJs and SMART).
Purpose/Use: a range of compliance purposes, including the submission of roll returns, daily attendance files, teacher subject collections, STAR response activities and school calendar (closed days) files. Learner and enrolment details, entries and results are sent to NZQA. Students details are uploaded to populate the Phonics Tool, PaCT and SMART.
Counties where data may be processed: New Zealand

5.3 Partner-built integrations are made using Directory Services, by the school. It is expected that in all such uses of Directory Services to share data with a third party that the school makes its own agreements, including all necessary and applicable due diligence, with the recipients of data shared.

5.4 Data for all other KAMAR services is processed internally and is not shared with third parties.


6. Storage and Security of Personal Information

6.1. We will take all reasonable technical and practicable precautions to protect personal information we hold about individuals, however we do not guarantee the security of the internet. We will never ask you to disclose your username and/or password.


7. Retention of Personal Information

7.1.  We will not store personal information collected by us longer than is necessary for the purposes for which it was collected. We destroy information within one year of the completion of the purpose for which the information was collected and held.

7.2. Notwithstanding the provisions of clause 7.1, we will retain documents containing personal information:

  1. To the extent required by law; or
  2. If we believe that the documents may be necessary for any legal proceedings.


8. Security

8.1. For hosted schools, all information provided to us will be stored securely on our New Zealand based private servers. Encryption will be used where applicable.

8.2. Access to the servers and to the data is limited to select KAMAR Limited team members from designated secure locations only.

8.3. Secure and encrypted backups are stored in a locked location off-site and adheres to our security and privacy policies.


9. Access to Personal Information

9.1. You have the right to access the personal information we hold about you.

9.2. If the information we hold about you is incorrect you have the right to request that the information we hold about you is corrected. If it is reasonable for us to correct that information we will do so. If not, we will include in the information that we hold about you a statement of the change you requested . We will notify you of the outcome of your request.

9.3. Requests for access and/or correction of personal information collected by an education provider and uploaded by them into KAMAR should be made to that education provider. Any such request we receive will be transferred to the appropriate education provider. We encourage you to make such requests directly to the education provider in the first instance to ensure such requests have the best chance of a quick and accurate response.

9.4. We may charge you our costs for providing any information requested that was collected and is held by us and any costs for requests to correct that information.

9.5. If you would like to access the personal information we collected about you and that we hold, please send an email to support@kamar.nz including your full name and the details of your request. We may request further evidence of your identification.


10. Collection of Other Information

10.1. We may also collect technical information relating to the use of our website and internet based services either by cookies and/or other means.

10.2. This information will be used to give us a better understanding of the use of our products and services, to improve the way they work, to offer a service or product that may be more suitable, to investigate a dispute, or for troubleshooting purposes.

10.3. We use third party providers for payment services, therefore we do not collect or store any information regarding bank account or credit card details.

10.4. Our software on your computers may interact with our servers to provide technical information about your computing environment for diagnostic and support purposes. Our software will periodically submit to our servers your update logs (which includes your IP address and organisation name) to confirm confirm the successful application of software updates, as well as information about your computing environment (software versions, operating system information).

10.5. Third party software used with our software may provide certain information to the relevant third parties. For example, FileMaker Pro - used to access our software - will provide to Claris International certain technical information as described in Claris International’s privacy policy https://www.claris.com/company/legal/privacy.html.


11. Use of AI

11.1 KAMAR provides a "Bring Your Own Key" integration with selected AI models to assist teachers with composing and adjusting report comments. The feature is disabled by default.

11.2 Information about the AI models available, including the information sent to each model, is available on the AI Comments page.

11.3 Personal information provided to an AI model through KAMAR is not used by KAMAR or the AI provider to train an AI model.

11.4 AI features cannot access the following categories of personal information and are never sent to any AI provider under any circumstances:

  • Student details such as names, dates of birth, nationalities, passport numbers, visa details, or photos.
  • Caregivers details such as names, contact details, or addresses.
  • Medical and health records, notes, or permission/consent information.
  • Payments or financial data.

11.5 The use of AI through KAMAR is controlled by the school. The school is responsible for selecting an AI provider, obtaining and managing the required API key, enabling the feature, and ensuring its use is appropriate for the school's requirements and obligations.


12. Feedback

12.1. If you have a concern or complaint about how we have collected, used, stored or disclosed personal information, please contact us at support@kamar.nz. We will acknowledge your complaint, investigate it and provide a response within a reasonable timeframe. We may request further information where necessary to investigate the complaint.

12.2 If you are not satisfied with our response, you may also make a complaint to the Office of the Privacy Commissioner, which provides guidance for making a complaint to them at the following link: https://www.privacy.org.nz/your-rights/making-a-complaint/.


13. Version History

Date Name Change Version
January 2022 Donna Lendrum Published existing policy on the KAMAR Website 2.0
January 2023 Donna Lendrum Reviewed 2.0
January 2024 Donna Lendrum Reviewed 2.0
January 2025 Donna Lendrum Reviewed 2.0
January 2026 Donna Lendrum Reviewed 2.0
August 2026 Hamish Gavin Minor formatting corrections 2.1
September 2026 Hamish Gavin Added sections 5, 8 and 11, plus clauses 10.4 and 10.5. Clarified abstract and section 12, plus clause 1.3. 2.2