The essentials
- Your school manages educational access and records; Petra Kevic SIA provides the technology.
- We use account, profile and school-work information to run the permitted service, not to sell pupil data.
- Photos are used for recognition within authorised school views, without facial recognition.
- You can ask your school or info@isplibrary.com about access, correction or erasure.
Who provides the platform
Petra Kevic SIA provides ISP Library as an IT service. Our registered address is the address recorded in the school service agreement. Contact us at info@isplibrary.com for platform and data-protection enquiries; your school administrator can also reach us through the contacts in that agreement.
For school-managed accounts, the school identified in your account normally determines why educational data are used and is the data controller. We normally process those data on the school’s documented instructions as its data processor. The school must provide its own privacy information, controller contact details and the applicable basis for its educational processing.
We may act as a separate controller for limited purposes we determine ourselves, such as responding to enquiries, administering our school service contract and protecting our own infrastructure against abuse. This does not authorise unrelated use of pupils’ educational records.
What information we use
- Account and school details: real given name and surname, username, email, phone, school, role, programme, class, approval status and access permissions.
- Profile: your uploaded photograph, its protected source and crop settings, and completion of the profile setup.
- Authentication: password hashes, account and Google identifiers where linked, verification and recovery records, temporary session information and necessary security state. We do not store normal account passwords as readable text.
- Learning work: saved books or reading preferences, tasks and exam drafts, assignments, responses, attached files, timing, submission records, marks, grades, teacher comments and the visibility chosen by the teacher.
- Communications: permitted conversations, message text, attached files, sender/recipient details, timestamps and unread/read state.
- Technical and security records: IP addresses and request/device information where needed by the hosting or security systems, sign-in attempts, administrative audit events and relevant secure-exam client checks.
- Account-rule acknowledgement: for a new self-registration, the Terms and Privacy Policy version and the server time of the registration checkboxes.
School content and free-text fields can contain additional personal information. Sensitive information is not required for an ordinary profile. Do not submit health, identity-document or other sensitive data unless your school has a specific lawful need and an appropriate protected process.
Why the information is needed
We use the information necessary to create and approve accounts, authenticate users, show permitted books and tools, manage classes and school work, exchange permitted messages, provide technical support and protect the service.
The school chooses the lawful basis for its educational activities. Depending on its role and circumstances, this may be an educational contract, a legal obligation or a public task. A school’s service agreement is not a blanket permission for every possible use of personal data.
For our own limited controller activities, processing may be necessary for a service contract, a legal obligation or a legitimate interest such as responding to an enquiry or preventing abuse. Legitimate interests must be assessed against the affected person’s rights, with particular care for children. Where a specific activity actually requires consent, we must ask for it separately and allow it to be withdrawn.
The required registration acknowledgement means you have read this notice. It is not consent to advertising, profiling or every future change.
Children, parents and profile photos
Your school must ensure that the account, data fields and profile-photo requirement are necessary and proportionate for its educational purpose. A clear, current photo helps authorised people recognise the account holder. It is not used by ISP Library for facial recognition or biometric matching.
Your photo is displayed within permitted parts of the school platform, including relevant profile and chat views. It is not a public marketing photograph. If a photo would create a privacy, safeguarding, accessibility or other justified concern, contact your school before uploading it. The school should assess an appropriate alternative identity-verification or approved-photo arrangement. An approved exception is not impersonation.
Where an information-society service is offered directly to a child and processing relies on the child’s consent, Latvian law sets the relevant consent threshold at 13. Below that threshold, parent or legal-guardian authorisation is required in that situation. This is not a general minimum school-platform age: school educational processing may use another lawful basis, and civil-law and school authorisation requirements still apply.
Parents register a separate account under their own identity. A parent account does not automatically reveal a child’s private messages, responses or grades. The school verifies and handles any authorised access request.
Who can see school information
Access is controlled on the server by account status, role, school and the applicable permissions. Teachers and school administrators see the information needed for their authorised tasks. The primary administrator manages additional access to Courses and Exams and other restricted tools.
Students see their assigned work and only the grades or comments that a teacher has released. Permitted conversation participants see the messages and files made available in their conversation. These descriptions do not give any user a right to inspect another person’s private account.
Provider personnel may access information where necessary for authorised support, security, maintenance or a legal obligation, subject to the relevant instructions and confidentiality. We do not sell pupils’ personal data.
Service providers and external content
The current platform uses Netlify for hosting, server-side functions and protected storage, and Supabase for parts of authentication and the gradual sign-in migration. Optional Google sign-in uses the identity information needed to identify the account, such as the Google identifier, name, email and profile picture. Choosing Google sign-in does not authorise general access to your mailbox or personal Drive.
School resource folders use Google Drive, and existing book readers may load external Heyzine content. When you open an external reader or file, that provider may receive technical request information such as your IP address. The school is responsible for selecting lawful content sources and assessing the providers it uses. Those providers’ own privacy notices also apply to their independent activities.
Public-page photographs are served from this website rather than hotlinked to photo platforms. The source and licence links are optional external links. Providers and support operations may process data outside the EEA; the applicable controller must ensure an appropriate transfer mechanism, such as a valid adequacy decision or contractual safeguards, and provide the relevant details. This notice does not claim that all processing occurs only in Latvia or the EU. Ask us or your school for the current provider and transfer information.
Browser and secure-application exams
Normal browser exams do not inspect other browser tabs, personal files or unrelated computer windows. They process the assigned responses, attachments and necessary exam timing and submission information.
For an exam that requires Safe Exam Browser, the separate application applies its configured restrictions on the device. The platform verifies relevant client/exam access information and stores the necessary attempt and submission state. Requirements and permitted arrangements must be explained by the school before the exam.
ISP Library does not activate webcam surveillance, microphone recording or biometric proctoring as part of these ordinary exam flows. Uploaded audio and images are content supplied through the relevant upload or school-material functions. The secure application has its own privacy and device behaviour; a lockdown configuration is not a promise that every possible device or security bypass can be detected.
How long information is kept
Information necessary for an active account is kept while the school authorises the account and the relevant service remains in use. Under the school-service retention arrangement confirmed for this notice, account data associated with a verified account-closure or erasure request are to be deleted or irreversibly anonymised within one calendar month, including applicable provider-held recovery copies within that scope.
A suspension or administrative archive is an access restriction; it is not itself a verified erasure request. It can preserve submitted work and school records. The school must specify any separate lawful retention needed for educational records, investigations or a legal obligation. Any exception to deletion must have a documented purpose and legal basis, be limited to the necessary data and duration, and be explained to the requester.
School messages and their attachments have a 30-day application lifetime. Short-lived authentication, recovery and session records have their own expiry rules. A service-contract retention commitment and an account archive are different processes; contact the school or provider to initiate and confirm actual erasure. We do not describe the archive button as automatic permanent deletion.
How we protect information
We remain responsible for our own data-protection and security obligations. Measures include protected server-side storage, hashed passwords, access checks, account approval, limited authentication sessions and verification/recovery controls. The exact arrangements must be maintained under the school service and data-processing agreement.
Keep your password and recovery information private. If you give credentials to another person, you are responsible for that disclosure to the extent allowed by law; it does not remove our liability for our own failures. Report suspected compromise promptly so the school or provider can restrict access and help secure the account.
No service can promise that an incident is impossible. We must handle relevant incidents, assist the school and make notifications where the applicable law requires them.
Your rights and how to use them
Depending on the processing and applicable conditions, you have rights to information, access, correction, erasure, restriction, objection and data portability. If a particular activity uses consent, you can withdraw that consent without affecting processing that was lawful before withdrawal.
For school-managed educational records, contact your school administrator or the school’s data-protection contact. You may also send a request to info@isplibrary.com; we will handle our own controller obligations or assist and route the request to the school where it is responsible. We may ask for the minimum information necessary to verify the requester. Never send your password.
Requests are normally answered within one calendar month. Where the GDPR permits an extension because of complexity or number of requests, the controller must inform you within the first month of the reason and revised timeframe. An account-rule appeal does not replace or shorten your data-protection rights.
You may complain to the Latvian Data State Inspectorate (Datu valsts inspekcija) or another competent supervisory authority, and use available judicial remedies. No platform rule waives those rights.
Enquiries and changes to this notice
The form on the public home page currently only prepares a message in your browser. ISP Library does not send the contents of this form or save drafts on its server. Your browser may retain or autofill field values, and any text you copy can remain in your device's clipboard. It is not a channel for submitting a formal request until delivery is actually connected and disclosed. Use info@isplibrary.com or your school’s established contact route instead. Email enquiries actually sent are processed to respond and meet any applicable obligations.
This notice is version 2026-10-12, published on 12 October 2026. Material changes must be communicated through the school or another appropriate channel. Existing accounts are not retrospectively recorded as having clicked new registration checkboxes. A changed notice does not create blanket consent or override the school agreement or mandatory law.
Legal references: GDPR, the Latvian Personal Data Processing Law and DVI guidance on educational platforms.