School Terms & Data Processing Schedule

1. Purpose

This schedule explains the roles and responsibilities of schools and VOICEi2a in relation to personal information collected through the VOICEi2a platform in an educational context. It is intended to support schools in meeting their obligations under the New Zealand Privacy Act 2020, the Education and Training Act 2020, and any applicable Ministry of Education guidance on student data privacy.

2. Parties and Roles

The school using VOICEi2a (the School) is responsible for deciding what information is collected, why it is collected, how it is used, and whether collecting it is appropriate. The School is the agency responsible for personal information collected from its staff, students, parents, and community through its use of VOICEi2a.

VOICEi2a acts as a service provider processing information on behalf of the School to deliver the agreed technology services. VOICEi2a does not decide the purpose of collection or use the School's data for its own independent purposes.

For account management, platform security, support, and operational administration, VOICEi2a may also hold limited information directly for its own purposes.

3. Scope of Processing

VOICEi2a may process the following categories of information on behalf of the School:

• audio recordings submitted through the platform
• transcripts generated from those recordings
• AI-generated summaries, themes, reports, and analytical outputs
• participant names and other identifiers included in recordings or forms
• technical and session metadata

4. Permitted Purpose

VOICEi2a processes information for the purpose of providing the School with transcription and AI-assisted analysis services. This includes generating summaries, themes, reports, and coaching feedback from recordings submitted by the School.

VOICEi2a will not use School data for any purpose other than delivering the service, unless required to do so by law.

5. School Responsibilities

The School is responsible for:

• deciding what information is collected and why
• ensuring collection is authorised and appropriate under the Privacy Act 2020 and other applicable law
• obtaining any notices or consents required before recordings are submitted, including parent or caregiver consent where student voice is involved
• ensuring staff and students are informed about how voice data is used
• ensuring the platform is used only for appropriate educational or organisational purposes
• reviewing AI-generated outputs before acting on them
• promptly notifying VOICEi2a of any suspected privacy incidents involving School data

6. Prohibited or Restricted Data

The platform must not be used to collect or store the following categories of information about students, staff, or other individuals unless the School has a clearly lawful basis and explicit approval:

• home addresses or residential location details
• dates of birth
• names or contact details of family members not directly relevant to the collection purpose
• passport, national identity, or other government identifier details
• banking or payment details
• medical, health, counselling, disability, or clinical information
• legal, safeguarding, or case-management information
• any information relating to formal disciplinary, investigation, or statutory processes

7. AI Use and Human Review

VOICEi2a uses AI tools to generate transcripts, summaries, themes, and reports. These outputs may contain errors, omissions, or inaccuracies. Schools must ensure that:

• AI-generated outputs are reviewed by a qualified person before being used or shared
• AI outputs are not treated as definitive records of what was said or decided
• AI outputs are not used as the sole basis for high-stakes decisions about a student, including decisions about wellbeing, assessment, learning pathways, or disciplinary matters

8. Subprocessors and Overseas Processing

To deliver the service, VOICEi2a uses third-party subprocessors that may process information outside New Zealand. By using VOICEi2a, the School acknowledges that recordings, transcripts, and related data may be processed in overseas jurisdictions.

Schools with specific data sovereignty requirements or obligations should consider this carefully before using the platform, and consult Ministry of Education guidance on overseas processing where relevant.

9. Current Core Subprocessors

VOICEi2a may update its subprocessors from time to time. Where a change involves a new subprocessor handling School data, VOICEi2a will update this schedule.

10. Retention and Deletion

Unless otherwise agreed in writing, audio recordings, transcripts, and AI-generated outputs are retained for up to 90 days from the date of submission, after which they are deleted from the active application environment.

Some logs, backups, and technical records may remain for a limited period as part of normal security and system recovery processes.

Schools may request earlier deletion of specific records where appropriate by contacting VOICEi2a directly.

11. Security

VOICEi2a takes reasonable technical and organisational steps to protect information from unauthorised access, loss, or disclosure. This includes encryption of data in transit and at rest, and access controls within the platform.

No system is completely secure. Schools are responsible for ensuring their staff use the platform appropriately and do not share access credentials.

12. Privacy Requests

Where a student, parent, caregiver, or staff member submits a privacy request (for access, correction, or deletion of information collected through the School's use of VOICEi2a), the School should manage that request in the first instance.

VOICEi2a can assist where the request relates to information held directly by VOICEi2a for operational purposes. Schools should contact VOICEi2a if assistance is needed.

13. Privacy Incidents

If VOICEi2a becomes aware of a suspected privacy breach involving School data, it will notify the School as soon as practicable and take reasonable steps to investigate and contain the incident.

Schools are responsible for assessing whether a notifiable privacy breach has occurred under the Privacy Act 2020 and, where required, notifying the Office of the Privacy Commissioner and affected individuals.

14. School Warranties

By using VOICEi2a, the School warrants that:

• it has lawful authority to collect and process the information submitted through the platform
• it has provided appropriate notices or obtained any required consents before submitting information
• it will not use the platform in breach of the Privacy Act 2020 or any other applicable law
• it will not submit prohibited or restricted data as described in section 6 without appropriate authority and explicit approval

15. Limitation on Use

VOICEi2a is a voice capture and AI-assisted insight tool. It is not a substitute for:

• student management systems or official student records
• pastoral care documentation or welfare case management
• clinical systems, health records, or disability support documentation
• formal safeguarding tools or child protection records
• legal or statutory reporting systems

16. Contact