Privacy Policy

Weft360 provides offline-first education management software — including WeftStudent (SIS), WeftLearn (LMS), WeftPeople (HRM) and related modules — to schools, district offices, and ministries of education. Our registered operating address is Paris, France.

For the personal data processed through our platform on behalf of a school, district, or ministry, that institution is the data controller and Weft360 acts as a data processor under their instructions. For data collected through our website and commercial communications, Weft360 is the controller.

• Contact and enquiry data: name, role, institution, email address, phone number, and message content submitted through our demo booking or partnership forms.
• Institutional platform data: student, staff, enrolment, attendance, assessment, and payroll records entered by an institution into our products.
• Account and authentication data: usernames, hashed credentials, role assignments, and access logs.
• Technical data: device type, browser, IP address, timestamps, and error diagnostics needed to keep the service secure and reliable.
• Usage data: aggregated feature usage and synchronisation statistics used to improve performance in low-connectivity environments.

• To deliver, configure, and support the products an institution has licensed.
• To respond to demo, demo, partnership, and support requests.
• To secure our systems, prevent misuse, and investigate incidents.
• To generate aggregated, non-identifying insights for product improvement and reporting to an institution.
• To meet legal, accounting, contractual, and audit obligations.

Where the EU General Data Protection Regulation or an equivalent national law applies, we rely on: performance of a contract (delivering licensed services), legitimate interests (securing and improving our platform, responding to business enquiries), consent (optional communications, where requested), legal obligation (record-keeping and lawful requests), and public task or official authority where a ministry or public body directs the processing.

Student records are processed strictly under the instructions of the institution that owns them. We do not sell student data, do not use it for advertising, and do not use identifiable student data to train commercial models. Access is role-based and limited to personnel who need it to deliver support.

Our products are designed to operate without continuous internet access. Data may be stored locally on school devices and synchronised to central servers when connectivity is available. Institutions are responsible for the physical security of local devices; Weft360 is responsible for encryption in transit and at rest on infrastructure we manage.

• With service providers (hosting, communications, analytics, and support tooling) bound by written data-processing terms.
• With the institution that owns the records, and with authorities it designates, such as a district or ministry reporting channel.
• Where required by applicable law, court order, or lawful regulatory request.
• In connection with a merger, acquisition, or reorganisation, subject to equivalent protection of your data.

Data may be processed in the country of the institution, in the European Union, or in other jurisdictions where our providers operate. Where data leaves its country of origin, we use appropriate safeguards such as standard contractual clauses or an in-country deployment option agreed with the institution.

Institutional records are retained for as long as the institution's licence is active and for any period required by its national education record-keeping rules. Website enquiry data is retained for up to 24 months. On termination, institutional data is exported to the institution and then deleted or anonymised within an agreed window.

• Encryption of data in transit and at rest on infrastructure we manage.
• Role-based access control, least-privilege administration, and audit logging.
• Regular backups and tested restoration procedures.
• Vendor review, staff confidentiality obligations, and security training.
• Incident response procedures, including notification to affected institutions without undue delay.

Depending on your jurisdiction, you may request access, correction, deletion, restriction, portability, or objection to processing, and you may withdraw consent where processing relies on it. If your data was entered by a school, district, or ministry, please contact that institution first; we will assist them in responding. You also have the right to lodge a complaint with your national data protection authority.

Our Cookie Policy describes this in detail. Our website uses only cookies and similar technologies that are necessary for the site to function, together with privacy-respecting aggregate analytics. We do not use advertising or cross-site tracking cookies. You can block cookies in your browser settings, though some features may not work as intended.

We may update this policy to reflect changes in our services or legal requirements. Material changes will be communicated to licensed institutions in advance, and the revision date at the top of this page will always show the current version.

Privacy enquiries: info@weft360.com. Postal contact: Weft360, Paris, France. Telephone: +33 7 53 11 00 02. See also our Terms & Conditions and Cookie Policy.